A customer came up with a requirement that they wanted to know and get the audit log of the following activities happening their environment:

  1. Users/Groups added/modified in the People and Groups list of the site.
  2. Any modification in the Site Collection Administrator section.
  3. User/Groups permission change in the Advanced Permissions section.

In MOSS 2007, to view the audit log for security related operations is a two step process.

  1. Enable the audit log for a specific entity
    • Under Site Collection Administration, click on Site collection audit settings
    • Select “Editing users and permissions” option.
    • From now on SharePoint will start storing the audit log in its database.
  2. Write a custom application using the SharePoint Audit APIs to view the audit log.

Here the sample code which will help you understand the audit entries and the event data associated with it. 

   1: SPSite siteColl = new SPSite("http://moss-server"); // Open a reference to Site Collection
   2: SPWeb site = siteColl.OpenWeb(); 
   3:  
   4: SPAuditQuery wssQuery = new SPAuditQuery(siteColl); //Create a SPAuditQuery object
   5: SPAuditEntryCollection auditCol = siteColl.Audit.GetEntries(wssQuery); //Query the Sharepoint DB for audit entries of this site collection
   6:  
   7: foreach (SPAuditEntry en in auditCol)
   8: {
   9:     switch (en.Event)
  10:     {
  11:         case SPAuditEventType.SecGroupCreate:
  12:             MessageBox.Show(en.EventData, "Security Group Created”);
  13:             break;
  14:                     
  15:         case SPAuditEventType.SecGroupDelete:
  16:             MessageBox.Show(en.EventData, "Security Group Deleted");
  17:             break;
  18:  
  19:          case SPAuditEventType.SecGroupMemberAdd :
  20:              MessageBox.Show(en.EventData, "User Added to Security Group”);
  21:              break;
  22:  
  23:         case SPAuditEventType.SecGroupMemberDel:
  24:             MessageBox.Show(en.EventData, "User Deleted from Security Group”);
  25:             break;
  26:  
  27:         case SPAuditEventType.SecRoleBindUpdate:
  28:             MessageBox.Show(en.EventData, "User Deleted from Security Group”);
  29:  
  30:         default:
  31:             MessageBox.Show(en.ventData);
  32:             break;
  33:     } 
  34: }

 

As always… Happy Coding