SOLVED

Audit Log Lags?

%3CLINGO-SUB%20id%3D%22lingo-sub-116161%22%20slang%3D%22en-US%22%3EAudit%20Log%20Lags%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-116161%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20is%20the%20lag%20time%20for%20the%20Security%20and%20Compliance%20centre%20Audit%20Logs%3F%3C%2FP%3E%3CP%3ETo%20give%20an%20idea%20of%20the%20lag%20we've%20noticed%2C%20a%20user%20did%20some%20things%20on%20Wednesday%20morning%20our%20time.%20The%20logs%20did%20not%20show%20the%20activity%20on%20Thursday%20at%206%20PM%20and%20only%20showed%20this%20on%20Friday%20morning%20(they%20may%20have%20appeared%20overnight%20but%20I%20wasn't%20watching%20then).%3C%2FP%3E%3CP%3EIs%20there%20any%20way%20to%20know%20if%20the%20audit%20logs%20are%20lagging%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-116234%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20Lags%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-116234%22%20slang%3D%22en-US%22%3E%3CP%3EDepends%20on%20the%20time%20of%20event%20and%20whether%20the%20service%20decided%20to%20perform%20as%20advertised%20on%20that%20day%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere's%20a%20table%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSearch-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c%23PickTab%3DBYB%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSearch-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c%23PickTab%3DBYB%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20you%20will%20often%20find%20that%20the%20SLAs%20are%20not%20met%2C%20in%20some%20cases%20it%20might%20even%20be%20days%20before%20the%20events%20appear.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Contributor

What is the lag time for the Security and Compliance centre Audit Logs?

To give an idea of the lag we've noticed, a user did some things on Wednesday morning our time. The logs did not show the activity on Thursday at 6 PM and only showed this on Friday morning (they may have appeared overnight but I wasn't watching then).

Is there any way to know if the audit logs are lagging?

1 Reply
Best Response confirmed by Andrew Warland (Regular Contributor)
Solution

Depends on the time of event and whether the service decided to perform as advertised on that day :)

 

There's a table here: https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-...

 

But you will often find that the SLAs are not met, in some cases it might even be days before the events appear.