This documentation is archived and is not being maintained.

Reading Entries from the Audit Log in Windows SharePoint Services 3.0

Windows SharePoint Services 3

Visual How To

Applies to:  Microsoft Windows SharePoint Services 3.0, Microsoft Office SharePoint Server 2007, Microsoft Visual Studio 2005

Ted Pattison, Critical Path Training

May 2007


Microsoft Windows SharePoint Services 3.0 introduces a powerful new infrastructure for auditing user access to list items, documents, and pages. However, you must write custom code to take advantage of this auditing infrastructure because no default features utilize it. Some of the other Visual How-To topics show you how to enable auditing. Here you can learn how to retrieve information from the audit log so that you can display and report on user activity within a custom solution based on Windows SharePoint Services.

Code It

Reading the audit log begins within the scope of a specific site collection. To read audit entries from the current site collection you must start by creating an SPAuditQuery object and initializing it with an SPSite object. Then you must call the GetEntries method on an auditable object such as the site collection itself and pass the SPAuditQuery object. The call to GetEntries returns an SPAuditEntryCollection object, with which your code can examine an entry in the target audit log by using a foreach (or For Each) loop.

SPSite siteCollection = SPContext.Current.Site;
SPAuditQuery wssQuery = new SPAuditQuery(siteCollection);
SPAuditEntryCollection auditCol;
auditCol = siteCollection.Audit.GetEntries(wssQuery);
// enumerate through audit log and read entries
foreach (SPAuditEntry entry in auditCol) {
    // inspect entry
Read It

The example shown here calls the GetEntries method on the Audit property of an SPSite object to return audit entries on all site collections. However, you can reduce the scope of the audit entries returned by calling GetEntries on the Audit property of another audit object within the site collection such as a site (SPWeb), a list or document library (SPList), or a list item or document (SPListItem).

Before calling GetEntries, you can also parameterize the SPAuditQuery object by calling some of its methods. You can call AddEventRestriction so that the audit query returns only certain types of audit entries such as updates and delete. You can call the RestrictToList method to return the entries specific to one list or document library. You can call the RestrictToListItem method to return the entries specific to one list item or document. You can call the RestrictToUser method to return the entries specific to a particular. Finally, you can call SetRangeStart and SetRangeEnd to return entries specific to a range of time.

Reading from the audit log is a restricted operation that requires site administrator permissions. That means the code shown here runs successfully only if the current caller is a site administrator. The code fails with an access-denied error for less privileged users such as site contributors and visitors. If you want to show audit information to user who do not have administrator permissions, you must write code to elevate privilege so that your code can succeed.
See It

Reading Audit Entries

Watch the Video

Length: 7:45 | Size: 26.3 MB | Type: WMV

Explore It