First published on MSDN on Nov 06, 2008
I've recently been doing some work analyzing audit logs for a customer. Exporting the audit logs via the Site Collection's Administration pages reports fails due to the amount of data I'm pulling back, so I've turned to the Object Model to get the data out. There's a small issue here, because the data that gets exported is poorly formed for recycle bin entries. The slash is missing in the closing <recycle> tag. In order to work around this, you're going to need to modify the entries with recycle tags to fix the trailing tag.
<AuditEntry><SiteId>ea85895e-d475-4744-9c50-7212963d9d98</SiteId><ItemId>9d14e64b-9d5c-411d-9218-58da76694e6a</ItemId><ItemType>Document</ItemType><UserId>AM\starservice</UserId><DocLocation>sites/star/medrequestform/Lebanon/Fulfillment_T2/200811/LBN-0065903.doc</DocLocation><LocationType>Url</LocationType><Occurred>11/1/2008 8:54:48 AM</Occurred><Event>Delete</Event><EventSource>SharePoint</EventSource><EventData><Version><AllVersions/></Version><Recycle>1<Recycle></EventData></AuditEntry>
The errors you'll likely see are "XML parse Error" and Error Code: -1072896659, Reason : End tag 'EventData' does not match the start tag 'Recycle'
