Forum Discussion

Copper Contributor

Aug 31, 2018

Incomplete data from Search-UnifiedAuditLog cmdlet for AzureAD record type

Hi, From the below cmdlet I got AuditData parameter as an incomplete JSON string. Search-UnifiedAuditLog -Operations 'Update User.' -RecordType azureactivedirectory -StartDate (Get-Date).AddDays...

Iron Contributor

Oct 28, 2018

from the docs https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance

There's a 3,060-character limit for the data that's displayed in the AuditData field for an audit record. If the 3,060-character limit is exceeded, the data in this field is truncated.

MVP

Oct 28, 2018

The problem is not the documented character limit. It is an ingestion problem for specific events that causes the JSON payload to be truncated as the record is written. Engineering is working on the issue.

Ryan Jacobson
Copper Contributor
Oct 29, 2018
Great - at the end of the day I am hoping for a valid JSON output. If individual fields have to be thrown away/truncated, so be it.
- TonyRedmond
  MVP
  Oct 29, 2018
  As I said, the truncation issue is being worked and we should have a solution soon. I am actively tracking the issue with engineering. See https://office365foritpros.com/2018/10/22/longer-retention-office365-auditdata/
  - Fromelard
    Iron Contributor
    Jan 28, 2019
    Dear all,
    
    Any news for that question ?
    
    I tried to use the Web interface to export the data and discovered that AuditData field limitation truncated to 3000 chars
    I created a dedicated PowerShell script using the special command:
    
    - Search-UnifiedAuditLog
    
    And found the truncate is also done at this Powershell level, so when that issue will be fixed ?
    
    Thanks for your feedback.
    
    PS:
    
    I posted a script to manage that AuditLog:
    
    - https://techcommunity.microsoft.com/t5/Office-365/PowerShell-script-to-export-Audit-log-search-Data-based-on/m-p/326589#M19622
    
    The limitation still exist with the PS command
    
    Fab

Resources