In Exchange Powershell, I can't get the complete audit events for particular period.

Question

When ever I run Search-UnifiedAuditLog cmdlet for the mentioned period it shows like there is 70 events but it return only 66. It was bug from Microsoft side?

Answer 1

Hi @Dineshkumar T ,

By research, this is normal. The Search-UnifiedAuditLog cmdlet presents pages of data based on repeated iterations of the same command. Use SessionId and SessionCommand to repeatedly run the cmdlet until you get zero returns, or hit the maximum number of results based on the session command. To gauge progress, look at the ResultIndex (hits in the current iteration) and ResultCount (hits for all iterations) properties of the data returned by the cmdlet.

Reference: https://learn.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps#:~:text=The%20Search%2DUnifiedAuditLog%20cmdlet%20presents,data%20returned%20by%20the%20cmdlet.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.