Sharepoint 2019 on-site audit logs show both opening and downloading as view event.

Stef STK 21 Reputation points
2021-03-15T14:48:41.663+00:00

Hello

I have a problem with Sharepoint 2019 on-site audit logs. We need to log opening, viewing, downloading, editing, deleting, restoring, moving, copying and editing permissions. Everything seems to be logged but opening, viewing and downloading are all shown as view events. How can I separate these events? Sharepoint online is not an option for us. What are my options with this problem?

SharePoint Server Management
SharePoint Server Management
SharePoint Server: A family of Microsoft on-premises document management and storage systems.Management: The act or process of organizing, handling, directing or controlling something.
2,889 questions
0 comments No comments
{count} votes

Accepted answer
  1. Emily Du-MSFT 43,836 Reputation points Microsoft Vendor
    2021-03-16T10:29:52.107+00:00

    @Stef STK

    I don’t think it’s possible to separate opening, viewing and downloading events in the audit logs. It’s by design.


    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


1 additional answer

Sort by: Most helpful
  1. Trevor Seward 11,696 Reputation points
    2021-03-17T18:17:55.55+00:00

    While separate events for downloading/viewing don't exist in any version of SharePoint, SharePoint Server 2019 did remove the View event which covered downloading, view, and view properties in a single event type. This event is problematic due to the content database impact it has and the inefficiency of removal of events from the database.

    You'll have to look for a 3rd party solution or parse IIS logs (i.e. with LogParser).

    0 comments No comments