SharePoint Audit Related Questions
 

Listed below is an overview of common audit related questions and their answers. If your question is not listed, please check out the other facilities in our Support area or contact us directly.
 

What SharePoint Events are audited?

The SharePoint Audit Suite supports all audit types provided by SharePoint. The administrator can select any combination of the following Audit Types to log.

Check In Check in of the object.
Check Out Check out of the object.
Child Delete Deletion of one of the object's child objects.
Copy Copying the object.
Delete Deletion of the object.
Move Move of the object.
Profile Change Change of a profile.
Schema Change Change of the object's schema.
Search Search of the object.
Security Change Change in a security configuration for the object.
Undelete Reversal of the deletion of the object.
Update Update of the object.
View Viewing of the object by a user.
Workflow Use of the object in a workflow task.

 

What Audit Events can be filtered for?

The Audit Suite's log viewer allows audit entries to be filtered for the following event types.

AuditMaskChange A change in the types of events that are audited for the object.
CheckIn Check-in of the object.
CheckOut Check-out of the object.
ChildDelete Deletion of one of the child objects of the object.
ChildMove Move of one of the child objects of the object.
Copy Copying of the object.
Custom Custom action or event.
Delete Deletion of the object.
EventsDeleted Deletion of audited events that are connected with the object from the SharePoint database.
Move Move of the object.
ProfileChange Change in a profile that is associated with the object.
SchemaChange Change in the schema of the object.
Search Search on the object.
SecGroupCreate Creation of a user group for a SharePoint site collection.
SecGroupDelete Deletion of a group that is associated with a SharePoint site collection.
SecGroupMemberAdd Addition of a new member to a group that is associated with a SharePoint site collection.
SecGroupMemberDel Deletion of a member from a group that is associated with a SharePoint site collection.
SecRoleBindBreakInherit Turning off inheritance of security settings from the parent of the object.
SecRoleBindInherit Turning on inheritance of security settings from the parent of the object.
SecRoleBindUpdate Changing the permissions of a user or group for the object.
SecRoleDefBreakInherit Turning off inheritance of role (that is, permission level) definitions from the parent of the object.
SecRoleDefCreate Creation of a new role (that is, permission level) definition associated with the object.
SecRoleDefDelete Removal of a role (that is, permission level) definition associated with the object.
SecRoleDefModify Changing a role (that is, permission level) definition associated with an object.
Undelete Restoration of an object from the Recycle Bin.
Update Changing the properties of an object or creating an object.
View Viewing of the object by a user.
Workflow Access of the object as part of a workflow.

 

Does the SharePoint Audit Suite add or modify any databases?

No, the SharePoint Audit Suite has been designed in such a way that it only uses official SharePoint APIs. It does not create any new databases nor does it access any of the SharePoint databases directly. After installing the Muhimbi Audit Suite your SharePoint environment is left in a state that is fully supported by Microsoft.
 

Does the SharePoint Audit Suite use any other 'hacks'?

No, the SharePoint Audit Suite has been designed in such a way that it only uses official SharePoint APIs. After installing the Muhimbi Audit Suite your SharePoint environment is left in a state that is fully supported by Microsoft.