Retrieve Sharepoint Audit Logs Programmatically Using C# Server-Side Object Model

Introduction

The Audit feature of Microsoft SharePoint Server or SharePoint Online lets you track the user actions on a site content types, lists, libraries, list items, and library files within your site collections. Knowing who has done what with which information is critical for many requirements, such as regulatory compliance and records management. In this article, you will learn how to retrieve SharePoint Audit Logs programmatically, using C# Server-Side Object Model. This will be applicable on all SharePoint On-Premise platforms.

Prerequisite

1. Create a site collection in SharePoint central admin.
2. Should have the site collection administrator permission.
3. Enable to Audit Log settings in your root site collection. Please follow the below steps.
   
   
• Click settings and then click Site settings.
• If you are not at the root of your site collection, under Site Collection Administration, select Go to top level site settings.
  
  NOTE: The Site Collection Administration section will not be available if you do not have the necessary permissions.
• On the Site Settings page, under Site Collection Administration, select Site collection audit settings.
• On the Configure Audit Settings page, in the Audit Log Trimming section, set Automatically trim the audit log for this site? to Yes.
• Optionally, specify the number of days of audit log data to retain.
• You can also specify the document library to save audit reports to before the audit log is trimmed. Set this option if you need access to audit log data, using audit log reports, after the audit log has been trimmed.  
  
  
  

Retrieve SharePoint Audit Logs using C# code

The following section explains the flow for retrieving SharePoint Audit logs.

1. Add the references to your C# project. The necessary references are Microsoft.SharePoint.dll.
2. Open the site using SPSite and SPWeb.
3. Initialize the object of SPAuditQuery.
4. We can restrict the Audit log value to specific list and list items using RestrictToList and RestrictToListItem.
5. We can specify the type of event should retrieve from audit log using AddEventRestriction. Events like views, search, download etc.
6. We can specify the duration of logs to be retrieved using SetRangeStart and SetRangeEnd.
7. Get the audit logs using GetEntries method.
8. Iterate the SPAuditEntryCollection to get the log values like DocLocation, UserId, ItemId, ItemType, Event, Occurred time, etc.
   

   try
   {
       using(SPSite site = new SPSite("https://SiteURL.com")) {
           using(SPWeb web = site.OpenWeb()) {
               SPAuditQuery query = new SPAuditQuery(site);
               //query.RestrictToList(list);
               //query.RestrictToListItem(ListItem);
               query.AddEventRestriction(SPAuditEventType.View);
               query.AddEventRestriction(SPAuditEventType.Search);
               query.SetRangeStart(DateTime.Now.AddHours(-1));
               query.SetRangeEnd(DateTime.Now);
               SPAuditEntryCollection auditCol = web.Audit.GetEntries(query);
               foreach(SPAuditEntry audit in auditCol) {
                   string docName = audit.DocLocation;
                   string userID = audit.UserId;
                   string ItemID = Convert.ToString(audit.ItemId);
                   string ItemType = Convert.ToString(audit.ItemType);
                   string EventType = Convert.ToString(audit.Event);
                   string OccuredDate = audit.Occurred;
               }
           }
       }
   } catch (Exception ex) {
       //Catch error in to ULS log.
   }

To view the above same Audit logs in SharePoint site, go to the location where audit reports like Shared Library are stored. We are able to view all the audit logs we got through the above code.

Summary

Thus, you have learned how to retrieve SharePoint Audit Logs programmatically, using C# Server-Side Object Model.