SharePoint Server auditing: do the auto-generated Excel reports mirror the data in the SQL AuditData table?

Question

question

GreenArrow-0825 asked Mar 31, '22 GreenArrow-0825 commented Apr 4, '22

SharePoint Server auditing: do the auto-generated Excel reports mirror the data in the SQL AuditData table?

I have a question about auditing in SharePoint Server 2016 (and higher):

Do the AuditTable table in the content databases in SQL and the auto-generated Excel reports contain the same data?

Or put another way: I am trying to understand if I will lose any information if I enable audit log trimming and just keep the automatically generated (Excel) reports? (I have examined the AuditTable and I think it looks like the Excel reports contain exactly the same data, but I am not sure...)

Thanks for any input!

office-sharepoint-server-administration

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-04-01T23:28:52.903Z

trevorseward answered Apr 1, '22 GreenArrow-0825 commented Apr 4, '22

The output is formatted slightly differently than the AuditData table, but the content is identical. Note that querying the AuditData table directly is not supported.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GreenArrow-0825 · Apr 04 at 08:50 AM

Brilliant, this was just what I needed to know. Thank you Trevor!

0 ·

Answer 2 · 2022-04-01T10:16:41.767Z

YiLu-MSFT answered Apr 1, '22 YiLu-MSFT commented Apr 4, '22

Hi @GreenArrow-0825
About audit log trimming, the default setting for retaining audit log data is zero days, that means if you don't specify a different retention period, all audit log entries are deleted at the end of the month (in the content databases in SQL). In addtion, we can also specify the document library to save audit log reports to before the audit log data is trimmed. Set this option if you need access to audit log data, using audit log reports, after the audit log has been trimmed:

For better understanding, you could refer to these two simialr case:
https://docs.microsoft.com/en-us/answers/questions/363002/sharepoint-2019-onprem-site-collection-audit-setti.html
https://docs.microsoft.com/en-us/answers/questions/261975/sharepoint-audit-log-trimming.html?page=1&pageSize=10&sort=oldest

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

image.png (88.6 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GreenArrow-0825 · Apr 01 at 12:09 PM

Thanks a lot for your reply, @YiLu-MSFT!

Set this option if you need access to audit log data, using audit log reports, after the audit log has been trimmed

So the generated audit log reports contain all data from the SQL audit logs? Maybe this is implied, but I just need to be sure that my client will not lose any audit data if they only keep the Excel files?

Thanks!

0 ·

question