SharePoint 2007 site collection auditing

We start the year with another in our series of SharePoint hints and tips from our expert Darren Pritchard. This time he’s looking at how to sucessfully audit SharePoint site collections.

To enable/disable SharePoint auditing:

1. Open the site that you wish to audit
2. Click ‘Site Actions’
3. Select ‘Site Settings’
4. Click ‘Modify All Site Settings’
5. Under ‘Site Collection Administration’ you have ‘Site collection audit settings’
6. You would see Figure 1.
7. Here you can select what you wish to audit
8. Be very careful, SharePoint will not automatically purge these audit logs. They will continue to grow as long as they are enabled. I have seen content databases with 80GB of audit files!

Figure 1: Configure Audit settings page

To trim audit files:

1. Create the batch file shown in Figure 2. Note: CONTENTDATABASE is the name of the database within SQL.
2. Save it as ‘Purge Audit Logs.bat’
3. This will need to be run on your SharePoint Web frontend server as an Administrator. Do not be alarmed if it takes a little while to run. The time it takes depends on the amount of audit logs you are trying to trim.

SET STSADM="c:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\bin\STSADM.EXE"

%stsadm% -o trimauditlog -date -databasename

Pause

Figure 2: Purge Audit Logs.bat

I would suggest running this on a system without users because it may have an impact on performance.

If you have large amounts of audit log files, I would recommend running the trim command on a month’s worth of audit logs at a time. The SQL transaction log file will grow very large during the trim process.

Once you have trimmed the audit logs you will need to run a shrink database task within SQL to reclaim the space used during the trim process.

I'd like to thank Darren for his continuing contributions, and a happy New Year to everyone.