View audit log reports

The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection:

• Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint sites)

• Edited items

• Checked out and checked in items

• Items that have been moved and copied to other location in the site collection

• Deleted and restored items

• Changes to content types and columns

• Search queries

• Changes to user accounts and permissions

• Changed audit settings and deleted audit log events

• Workflow events

• Custom events

You can use the following audit log reports provided with SharePoint to help determine who is taking what actions with the content of a site collection:

• Content viewing    Reports users who have viewed content on a site. In SharePoint, this report will be blank as these events are not captured during auditing.

• Content modifications    Reports changes to content, such as modifying, deleting, and checking documents in and out.

• Deletion    Reports what content has been deleted.

• Content type and list modifications    Reports additions, edits, and deletions to content types.

• Policy modifications    Reports on events that change the information management policies on the site collection.

• Expiration and Disposition    Reports all events related to how content is removed when it expires.

• Auditing settings    Reports changes to the auditing settings.

• Security settings    Reports changes to security settings, such as user/group events, and role and rights events.

• Run a custom report    You can specify the filters for a custom report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.

Following is a sample Deletion audit log report. It is representative of the other audit log reports.

• A summary of the audit data is provided as a PivotTable on the Audit Data – Table worksheet of the workbook.

  

• The data for the report is provided on the Report Data 1 worksheet of the workbook.

  

To view an audit log report:

1. Click Settings , and then click Site settings.

2. Click Audit log reports in the Site Collection Administration section.

3. Select the report that you want, such as Deletion on the View Auditing Reports page, .

4. Type a URL or Browse to the library where you want to save the report and then click OK.

5. On the Operation Completed Successfully page, click click here to view this report. If you get an error, it may be because audit logs weren't enabled or there was no data to show. See Configure audit settings for a site collection to be sure event logging is set up.

   Notes: 

   • At least Excel version 2013 must be installed to view audit log reports by clicking click here to view this report.

   • Alternatively, if opening documents in the browser is enabled for the library, go to the library where you saved the audit log report, point to the audit log report, click the down arrow, and then click View in Browser.

You can use standard Excel features to narrow the reports to the information you want. Some ways in which you can analyze and view the log data include:

• Filtering the audit log report for a specific site.

• Filtering the audit log report for a particular date range.

• Sorting the audit log report.

• Determining who has updated content.

• Determining which content has been deleted but not restored.

• Viewing the changes to permissions on an item.