Share via

PowerShell: custom module to Download audit log report

  • Article

Background

So, as you are probably aware, that out of the box there is no way to identify from the audit log report the <document created> / <document uploaded> events in SharePoint Server 2013 (so far, the same is valid for the 2016 Beta II).

One customer required this information. The simplest way to gather it seemed to be via PowerShell.

Module

We have created a small module, which can be imported on your machine to run the functions and export the data from SharePoint to a CSV file. To do this, follow the steps:

  1. Navigate to the folder **%userprofile%\documents **
  2. You will need to create there (if it does not exist) the folder \WindowsPowerShell\ and inside it \Modules\ and then one more folder inside it: \AuditReport\
  3. Copy the module file AuditReport.psm1 to that folder;
  4. The full path will look like this: %userprofile%\Documents\WindowsPowerShell\Modules\AuditReport\AuditReport.psm1
  5. Open a PowerShell Window and run:

 

PowerShell

import-module AuditReport

After some time, the SharePoint cmdlets and the custom functions will be loaded and you can call the "interface", using:

PowerShell

Start-AuditReportInterface

 

This will take a while and you will eventually see the three options:

https://gallery.technet.microsoft.com/site/view/file/147130/1/Audit4.png

Option 1

Option 1 is for calling the function Get-DocumentLibStatistics, which will generate the file statistics for all document libraries in the site you have chosen and at the location you specified. ("Site Assets" and "Style Library" have been removed from the loop)

Here's how it looks:

https://i1.gallery.technet.s-msft.com/sharepoint-server-2013-9657c24e/image/file/147153/1/audit1.png

As you can see, it shows you which library did it find on the site and the Date Created and User Login for each document. It will display everything in the Shell, but also export the results to the chosen location in a similar format to the one you have when you generate the Out Of the Box Audit Report.

https://i1.gallery.technet.s-msft.com/sharepoint-server-2013-9657c24e/image/file/147151/1/audit2.png

When it is done, it will show you where it saved the file and return to the menu.

Option 2

Custom Audit Report - will generate an audit report with custom date ranges and in the same format it uses, when you generate it from site settings - Audit log reports.

https://i1.gallery.technet.s-msft.com/sharepoint-server-2013-9657c24e/image/file/147152/1/audit3.png

It will also ask you where to save the exported CSV and what is the start date and end date.

Please note, that in order to simplify working with dates, we have included the date format sample in the question (as well as a reminder of the current date), as it varies, depending on the Windows Server time/regional settings. You might see it in MM/DD/YYYY or DD.MM.YYYY or any other valid format.

We decided to not use parameters, as validating URLs with regex was too much of a pain. If needed, you can add data about the user who modified the file. It is only a matter of adding the property to the ones we merge in the custom PSObject.