-
Title
Audit Log Analysis does not return data before a specific date -
Description
The Audit Log Analysis report does not show entries before a specific date. -
Cause
The issue may be caused by one or both of the following:
- SharePoint auditing is not enabled for the site collection on which the report is being run.
- The audit logs are being trimmed through SharePoint or ControlPoint.
-
Resolution
ControlPoint’s Audit Log Analysis report collects data from SharePoint’s built-in audit collection. In order to return results for this report, SharePoint auditing must be enabled and data must be collected for the scope of the report.
- Check the Site Collection Audit Settings for the site collection being audited. For web-level auditing, the audit settings are defined at the site collection level.
1. Navigate to Site Settings for the site collection.
2. Under the Site Collection Administration category, open the Site Collection Audit Settings.
3. Confirm that the Automatically trim the audit log for this site setting is either disabled or set to a number of days that would include the scope of the report.
4. Confirm that the audit events for the site collection are enabled for the event you are trying to report on.
- If these audit events are in place, confirm that the ControlPoint application is not truncating audit data.
1. Navigate to the ControlPoint Settings list in the ControlPoint Configuration Site (e.g. http://servername:1818).
2. Expand out the Audit Log category and look for the AUDITMAXDAYS parameter.
3. Its parameter value should be set either to 0 (for keep forever) or a specific date. Confirm that the date range covers the scope of your report.