#Sharepoint audit windows

The Sharepoint Audit Log collection solution I ultimately came up with requires a number of custom integration points and also introduces a custom Database located on the Sharepoint Database server. So, going the traditional route of defining a SQL query and utilizing Mcafee’s SQL collector was not a viable option, though in many small environments I suspect this might be fine.

#Sharepoint audit windows

Additionally, querying the SharePoint database directly using the Windows x32 based McAfee SQL Collector against my custom “Auditing” SQL view resulted in the collector crashing with every attempt, I suspect from what seemed like a memory leak. I needed to audit the activity of a highly used SharePoint Farm, this was a farm used primarily as a document management system for a firm. Auditing was required on all document access not just administrative activity which resulted in an average log volume of 1 million records per 24 hr period. This greatly outstripped the capability of using SharePoint auditing exports via powershell or SharePoint tasks and caused reliability issues with Logbinder for SharePoint (an otherwise excellent 3rd party product). It seemed a shame to throw away, hopefully it can still help someone.

This re-post from an old WordPress blog I'm decomissioning is written to outline getting an on-premise Sharepoint environment's audit events in Mcafee SIEM product. Since this solution exports Sharepoint audit events to flat text log files as an intermediate step, this solution could be easily amended to work with any third party log analysis tool. Custom Solution to Audit a highly active SharePoint Farm by Mark Colatosti.