Event Logs in SharePoint Foundation
Applies to: SharePoint Foundation 2010
Creation of alert messages occurs after the change that generated the alert. Data in the event log is used for the alerts because the changed item may not exist or may exist in a different form at the time the message is sent.
The event log uses a SQL table named EventCache to record SQL-level events as they occur. Each row in the table corresponds to an event. The events can be read by using the SharePoint Foundation object model. For information on how to access change log entries programmatically, see the Logging For SharePoint Developers node of this SDK.
The number of rows written to the table is the minimum necessary to capture the semantics of the event. The assumption is that the reader of the event knows how to use the event row to calculate all the implications of a given event. For example, when a folder is deleted, the folder-deletion event is the only event written to the change log. No events are written for the files and subfolders that are contained in the folder. The reader of the folder-deletion event must understand that it implies the deletion of the entire contents of the folder.
By default, the change log retains 15 days worth of data. You can configure this in the Central Administration application. A timer job runs daily to delete all expired change log entries.