question

StefSTK-5768 avatar image
0 Votes"
StefSTK-5768 asked trevorseward answered

Sharepoint 2019 on-site audit logs show both opening and downloading as view event.

Hello

I have a problem with Sharepoint 2019 on-site audit logs. We need to log opening, viewing, downloading, editing, deleting, restoring, moving, copying and editing permissions. Everything seems to be logged but opening, viewing and downloading are all shown as view events. How can I separate these events? Sharepoint online is not an option for us. What are my options with this problem?

office-sharepoint-server-administration
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

EmilyDu-MSFT avatar image
0 Votes"
EmilyDu-MSFT answered StefSTK-5768 commented

@StefSTK-5768

I don’t think it’s possible to separate opening, viewing and downloading events in the audit logs. It’s by design.


If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.




· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for the answer. So Microsoft just removed the option to push people to sharepoint online? What are my other options with microsoft products or I'm only left with 3rd party solutions for on-site audit logging?

0 Votes 0 ·

@StefSTK-5768

Microsoft does not remove the option. In the SharePoint server, by default that it’s impossible to separate opening, viewing and downloading events in the audit log.

SharePoint does not have other options to achieve this.

You could go to the User Voice to make your suggestion or use third party solutions.


If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 Votes 0 ·

Thank you for the answer. To clarify, I was talking about older sharepoint (2016) where I'm pretty sure the option for separating events existed.

0 Votes 0 ·
trevorseward avatar image
0 Votes"
trevorseward answered

While separate events for downloading/viewing don't exist in any version of SharePoint, SharePoint Server 2019 did remove the View event which covered downloading, view, and view properties in a single event type. This event is problematic due to the content database impact it has and the inefficiency of removal of events from the database.

You'll have to look for a 3rd party solution or parse IIS logs (i.e. with LogParser).

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.