Event Logs in Windows SharePoint Services

This content is outdated and is no longer being maintained. It is provided as a courtesy for individuals who are still using these technologies. This page may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

Rendering of alert e-mail messages occurs after the change that generated the alert. Data in the event log is used for rendering of alerts because the changed item may not exist or may exist in a different form at the time the e-mail message is sent.

The event log uses a SQL table named EventCache to record SQL-level events as they occur. Each row in the table corresponds to an event. The events can be read by using the Windows SharePoint Services object model.

The number of rows written to the table is the minimum necessary to capture the semantics of the event. The assumption is that the reader of the event knows how to use the event row to calculate all the implications of a given event. For example, when a folder is deleted, the folder-deletion event is the only event written to the change log. No events are written for the files and subfolders that are contained in the folder. The reader of the folder-deletion event must understand that it implies the deletion of the entire contents of the folder.

Note

When you upload a file to multiple Windows SharePoint Services 3.0 document libraries, an alert e-mail message is sent from the document libraries as expected. However, an alert message is sent from only one document library. You might expect an alert message to be sent from all the document libraries to which you uploaded the file. This issue has been addressed in the April 12, 2007, hotfix package. For more information, refer to Windows SharePoint Services 3.0 hotfix package: April 12, 2007.

By default, the change log retains 15 days worth of data. You can configure this in SharePoint using the Web Application General Settings page located on the Central Administration page.. A timer job runs daily to delete all expired change log entries.

Change Events

Change events are returned as objects in an SPChangeCollection object. Each change object is a subclass of the SPChange object. Depending on the type of SPChange object, different properties are available. The change collection is created by calling SPSite.GetChanges, SPWeb.GetChanges, SPList.GetChanges, or SPContentDatabase.GetChanges. An SPChangeToken object is passed to GetChanges to specify where in the log to begin reading. An SPChangeToken object can be serialized to a string format by calling the ToString method.

Use the SPList.CurrentChangeToken property to get the current change token for that list object. You can find similar properties on the SPSite, SPWeb, and SPContentDatabase objects.

In general, the SPChangeToken object from one object cannot be used in the GetChanges method of another object. The only exception is that the SPChangeToken object from a SPContentDatabase object can be used in any object that is contained in that content database.

There is also an object named SPChangeTokenCollection that you can use to store multiple change tokens together. You can then serialize the change tokens to a single string.

Change Log Event Types

The following table is a description of the event types that are recorded in the change log. Only the Add, Modify, Delete, Rename, and Restore event types are visible to alerts.

Table 1. Event types

Event Type	Description
Add	An object was added. For items, files, and folders, the TimeLastModified value in the log should be the same as the Created property of the object.
Modify	An object was modified. For items, files, and folders, the TimeLastModified value in the log should be the same as the Modified property of the object.
Delete	An object was deleted.
Rename	An object was renamed. This means that the file name portion of the URL was changed.
MoveInto/MoveAway	An object was renamed. This means that the path portion of the URL was changed. The file name portion may or may not have been changed also.
Restore	An object was restored from the Recycle Bin or from a backup. This event signals to the change-log reader of a sync client that it must resynchronize the object and all its children.
Role Add	A role was added at the scope of the object.
Assignment Add	A role assignment was added at the scope of the object.
System Modify	An object was modified without its Modified or Modified By property changing. The TimeLastModified value in the log should be the time that the update occurred, not the Modified property.
Member Add	A member was added to a SharePoint group.
Member Delete	A member was deleted from a SharePoint group.
Role Delete	A role was deleted at the scope of the object.
Role Update	A role was updated at the scope of the object.
Assignment Delete	A role assignment was deleted at the scope of the object.
Navigation	The navigation nodes were updated at the scope of the object.

Object Types

The following table is a list of the object types that may have changes recorded in the change log. Not all event types are possible on all object types.

Table 2. Object types

Object Type	Description
Item	This object type applies to all objects that exist in a list: list items, files, and folders.
List	List object type.
Web	Web object type.
Site	Site object type.
File	This object type applies to files that exist outside of a list and do not have corresponding items.
Folder	This object type applies to folders that exist outside of a list and do not have corresponding items.
Alert	Alert object type.
User	User object type.
Group	Group object type.
ContentType	Content object type.
Field	Field object type.
SecurityPolicy	A security policy change has been made at the Web application level that affects the entire content database. This event was added late in the development cycle, so it and the content database–level restore event are logged as a site-level event with a SITEID of "00000000-0000-0000-000000000000".

See Also

Concepts

Alerts in Windows SharePoint Services