Reading Entries from the Audit Log in Windows SharePoint Services 3.0

Applies to:  Microsoft Windows SharePoint Services 3.0, Microsoft Office SharePoint Server 2007, Microsoft Visual Studio 2005

Ted Pattison, Critical Path Training

May 2007

Microsoft Windows SharePoint Services 3.0 introduces a powerful new infrastructure for auditing user access to list items, documents, and pages. However, you must write custom code to take advantage of this auditing infrastructure because no default features utilize it. Some of the other Visual How-To topics show you how to enable auditing. Here you can learn how to retrieve information from the audit log so that you can display and report on user activity within a custom solution based on Windows SharePoint Services.

Reading the audit log begins within the scope of a specific site collection. To read audit entries from the current site collection you must start by creating an SPAuditQuery object and initializing it with an SPSite object. Then you must call the GetEntries method on an auditable object such as the site collection itself and pass the SPAuditQuery object. The call to GetEntries returns an SPAuditEntryCollection object, with which your code can examine an entry in the target audit log by using a foreach (or For Each) loop.

The example shown here calls the GetEntries method on the Audit property of an SPSite object to return audit entries on all site collections. However, you can reduce the scope of the audit entries returned by calling GetEntries on the Audit property of another audit object within the site collection such as a site (SPWeb), a list or document library (SPList), or a list item or document (SPListItem).

Before calling GetEntries, you can also parameterize the SPAuditQuery object by calling some of its methods. You can call AddEventRestriction so that the audit query returns only certain types of audit entries such as updates and delete. You can call the RestrictToList method to return the entries specific to one list or document library. You can call the RestrictToListItem method to return the entries specific to one list item or document. You can call the RestrictToUser method to return the entries specific to a particular. Finally, you can call SetRangeStart and SetRangeEnd to return entries specific to a range of time.

Note
Reading from the audit log is a restricted operation that requires site administrator permissions. That means the code shown here runs successfully only if the current caller is a site administrator. The code fails with an access-denied error for less privileged users such as site contributors and visitors. If you want to show audit information to user who do not have administrator permissions, you must write code to elevate privilege so that your code can succeed.

Watch the Video

Length: 7:45 | Size: 26.3 MB | Type: WMV