SharePoint
- List audit log(s)
Declaration
<AMSHAREPOINT ACTIVITY="list_auditlogs" SITEURL="text" RESULTDATASET="text" />
Description
Retrieves a list of audit logs for a site collection, and then creates and populates a dataset with the results.
- This activity only supports SharePoint 2016 and 2019 Server with the 64-bit version of Automate.
- SharePoint-related error messages appearing in Automate are sent from your SharePoint site or server. Automate displays these messages verbatim. For information on SharePoint error messages, refer to Microsoft's SharePoint documentation.
Practical usage
Retrieves audit logs for reporting purposes or to perform other SharePoint activities on them recorded. Knowing who is taking what action and causing the event in your site collection is critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management.
Parameters
Server
| Property | Type | Required | Default | Markup | Description |
|---|---|---|---|---|---|
| Site | Text | Yes | (Empty) | SITE="http://myServer/folder" | The SharePoint site from which to retrieve audit logs. |
| Create and populate dataset with SharePoint audit log(s) information | Text | Yes | (Empty) | RESULTDATASET="the_audit_logs" | The name of the dataset to create and populate with information about the retrieved audit logs. See Datasets for more information. |
Additional notes
Datasets
A dataset is a multiple column, multiple row container object where every column represents a particular variable, and each row corresponds to a given member of the dataset in question. This activity creates and populates a dataset containing specific fields (rows) in addition to the standard dataset fields. The table below describes these fields (assuming the dataset name assigned was theDataset).
| Name | Type | Return Value |
|---|---|---|
| theDataset.DocumentLocation | Text | The location of the audited object at the time of the audited event. |
| theDataset.Event | Text | The value that identifies the type of event. |
| theDataset.EventData | Text | The data, in XML markup, that is specific to the type of event identified in the theDataset.Event field. |
| theDataset.EventName | Text | The name of the type of a custom audited event. |
| theDataset.EventSource | Text | The value that indicates whether the event occurred as a result of user action in the SharePoint user interface or programmatically. |
| theDataset.ItemId | Text | The globally unique identifier (GUID) of the audited object |
| theDataset.ItemType | Text | The type of object associated with the event. |
| theDataset.LocationType | Text | The value that indicates where the event occurred. |
| theDataset.MachineIP | Number | The IP address of the computer that initiated the event. |
| theDataset.MachineName | Text | The name of the computer that initiated the event. |
| theDataset.Occured | Date | The date/time of the event. The returned date/time format matches the following: MM/DD/YYYY HH:MM:SS AM/PM. |
| theDataset.SiteId | Text | The globally unique identifier (GUID) of the site collection. |
| theDataset.SourceName | Text | The name of the application that caused the event. |
| theDataset.UserId | Text | The SharePoint user ID who caused the event. |
Example
- Copy and paste the sample AML code below directly into the Task Builder Steps Panel.
- To successfully run the sample code, update parameters containing user credentials, files, file paths, or other information specific to the task to match your environment.
Description
This sample task retrieves a SharePoint site's audit logs, and then creates and populates a dataset with the results.
<AMSHAREPOINT ACTIVITY="list_auditlogs" SITEURL="http://server_name/sites/site_name" RESULTDATASET="the_audit_logs" />