23 July, 2012

SharePoint 2010-Cannot view audit log reports on site collection

Auditing-Knowing who is taking what action on which content in your site collection can be critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management. You save an audit log report as a Microsoft Excel 2010 workbook to a library in the site collection that you specify.
Few months before, I have already written an article on auditing configuration and I really wanted to thank you for your kind responses: http://sharepointknowledgebase.blogspot.in/2010/09/sharepoint2010-site-collection-auditing.html
But now in this article, I am trying to concentrate on one of the incident which has been faced by the local team members.
The issue was: After being enabled the Audit log reports, the link to "Audit log reports” remains unavailable (does not appear) on site collection settings
See, it was very easy to troubleshoot this issue so I request you to follow the below mentioned steps and I am pretty much confident that your issue will be resolved.
Resolution:
I am providing you two options here so you can use anyone as per your flexibility.
Note: in both the options, you must be site collection administrator for the site collection.
Option1:
1.   Open command prompt ( Start-> Run and type cmd ) 
2.   Change to the SharePoint 2010 path (\programfiles\Common files\Microsoft Shared\web server extensions\14\bin) 
3.   Run STSADM.EXE -o activatefeature -name Reporting -url http://sitecollectionurl -force (this may take a while on finishing) 

Option2:
1.   On the site that the Audit log reports are going t be activated
2.   Site Actions
3.   Site settings 
4.   On Site collection administration section
5.   click on Site Collection Features 
6.   Search for the Reporting feature 
7.   Click on Activate button 

Go back to Site Actions->Site Settings and on Site Collection administration section and verify that the link is available now

Please let me know in case of any queries/questions regarding the above mentioned information. I would be more than happy to help you as well as resolves your issues J J

28 comments:

  1. Option 2 worked for me. I don't think I'd have worked this out without this blog. Thanks

    ReplyDelete
  2. I have not enabled audit reporting in my site collection, if I enable now would it be possible for me to see the logs like who has uploaded / deleted the content previously? thanks in advance

    ReplyDelete
  3. No, it should be enabled before.

    But you can enable now so it will be useful from future perspective.

    ReplyDelete
  4. Thanks a lot for the reply Amol :) I would like to know how to interpret / analyse the excel we obtained from the results, the reason why I am asking this we have done so much of activities in a site collection but if open a audit log only few activities are recorded for example number of views for _catalogs/masterpage which is nothing but homepage visits right? PS: I have tried all the option under the audit log link in site collection administrations and checked the sheet 2 that is report data in the excel sheet. If you help me that would be gr8!

    ReplyDelete
  5. make sure what kind of options you have checked in the audit settings- that's the vital step.

    as you can able to see the view entries, try to delete any thing example list/library and then check the auditing entries, it has to reflect there without any issues. also the excel sheet contains multiple tabs within that, make sure you are checking all the ones

    Please check and let me know in case of any queries, thank you

    ReplyDelete
  6. Amol thanks again for the fast reply! you are so kind enough :) like I told you there are so much of activities going on in the site collection that includes deletion of contents even deletion of some sub sites I have tried a different combination like only deletion in audit settings and choosing the deletion event in audit log it showed me "No data error"? this is the part am confused using the feature

    ReplyDelete
  7. You can now use standard Excel features to narrow the reports to the information you want. Some ways in which you can analyze and view the log data include:

    -Filtering the audit log report for a specific site.
    -Filtering the audit log report for a particular date range.
    -Sorting the audit log report.
    -Determining who has updated content.
    -Determining which content has been deleted but not restored.
    -Viewing the changes to permissions on an item.

    Run a custom report-- You can specify the filters for a custom report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.

    The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection:

    Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint Online sites)
    Edited items

    Checked out and checked in items

    Items that have been moved and copied to other location in the site collection

    Deleted and restored items

    Changes to content types and columns

    Search queries

    Changes to user accounts and permissions

    Changed audit settings and deleted audit log events

    Workflow events

    Custom events

    ReplyDelete
  8. Hi Amol,
    I tried both the options, but I couldn’t find the solution.
    Option 1:
    When I tried option 1 using command prompt, I faced an error as
    “Failed to find the XML file at location ‘14\Template\Features\Reporting\feature.xml”
    Option 2:
    Reporting feature is not available in site collection features.
    Please help me out from this issue.

    ReplyDelete
    Replies
    1. Did you do an in place upgrade? Did the 2007 farm have any custom solutions deployed?

      If you install a feature in your sharepoint farm and after that the feature folder or the feature manifest file accidently gets deleted from your Web Front End servers file system, you will get the error "Failed to find the XML file at location '14\Template\Features\Feature_Name\feature.xml"

      How many FE's you have?

      check the other front end in reference to the same location? if the feature is the there then copy-paste the same on other front end.

      Delete
  9. Trying to see who deleted users access on site so running audit log report from site collection by selecting deltion category.
    Given path as documents
    Throwing error as it cant contain any data.
    Access was lost 3 days back
    Restored also
    wanna chk how it was done
    Any inputs?
    I am new to SP 2010
    Rakesh

    ReplyDelete
    Replies
    1. Make sure it was enabled/checked before the data got deleted.

      in the audit settings, check the appropriate boxes that you required and try deleting anything. this will definitely gets captured inside the deletion logs.

      let me know in case of any queries, Thank you.

      Delete
  10. Hello Amol,

    Thanks for the explanation on where to find the reports.
    This part is sadly missing on most of the articles explaining how to turn on the auditing.

    Kind regards,
    Philippe

    ReplyDelete
    Replies
    1. Thank you Philippe 4 your kind words.

      Please let me know in case of any queries and issues.. I will try my best ti resolve it as soon as possible!!

      Delete
  11. Thank you very much. I activated Report feature and I now I can see the link to "Audit log reports”

    ReplyDelete
  12. Hi Amol,
    Can a person who has only site admin and not site collection admin can retrieve Audit Logs using SOM AuditQuery class?


    Thanks,
    Harika

    ReplyDelete
    Replies
    1. No, site admin cannot retrieve, he should be a site collection administrator to retrieve the audit logs.

      Let me know in case of any further queries, thank you.

      Delete
  13. Hi Amol,
    Facing an issue here in Audit Reports. The issue is when one site collection admin tries to run the Security Settings Audit report the report is getting generated successfully; however if another site collection admin treis to run the same report he gets an error. When checked in to the log files the error was "System.Runtime.InteropServices.COMException: Error HRESULT E_FAIL has been returned from a call to a COM component. at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal​"

    Any ideas??

    Thanks,
    Sumukh

    ReplyDelete
    Replies
    1. I hope that user don't have multiple domain ID's, Please check this and confirm. additionally, just to isolate the thought, did you check this in multiple browsers? I would suggest to check once. let me know the results.

      Delete
  14. Thanks for this Amol. However, the user do not have multiple Domain Ids. Also, we checked on a same browser of a single machine; it works for a user ID & fails for another.

    ReplyDelete
    Replies
    1. Ok, here is the plan-

      for whom its not working, let him logged in to the sharepoint site

      Open the SharePoint site

      IE -> Tools -> compatibility settings

      Check "Dispaly all websites in compatibility view".

      add your sharepoint site on the top ("add this website" section) if its empty (by default it takes but sometimes its not)

      refresh it and check the results

      Delete
    2. OK, lets try to test one more use case-

      Open your site -> Site actions ->site settings -> people and groups -> click on any group -> that group will be highlighted in the right hand side -> On the top in the explorer ->You will see the group ID (something like group id=56) -> change this number to 0 -> Hit Enter -> this will open all users which are a part of of your site -> now select the user who is having the problem -> actions -> Delete user from site collection -> This will remove him from the complete site.

      -Go to the site collection admin section -> add that user and check again.

      Let me know the results. Thanks.

      Delete
    3. Hello Amol,
      Thanks for this. But after executing the test case still getting the same error.

      Thanks,
      Sumukh

      Delete
    4. Is this not working only on this site? did you try on any other site collection?

      Delete
  15. Thank you SOOO much for your help! I have been searching for a while trying to find a solution to this and being able to view audit logs and found nothing until this site. Thanks for posting this most helpful information.

    ReplyDelete
    Replies
    1. Awesome :) Thanks Benton for the confirmation!

      Delete
  16. The custom report for user permission changes only shows the groupid instead of the group name, we have 780+ groups is there an easy way to get the name instead of the id number? Thank you.

    ReplyDelete
  17. Great article, I found proficient application from http://www.lepide.com/sharepoint-audit/ which enables to to track site collection users/administrative activity and view of documents, document libraries, users, permissions, accesses, site, folders and generate sophisticated report on demand. It gives the complete visibility of your Sharepoint Server (Who has done and What, When, Where, changes on the server and at which SharePoint site ).

    ReplyDelete

Your feedback is always appreciated. I will try to reply to your queries as soon as possible- Amol Ghuge

Note: Only a member of this blog may post a comment.