Audit log report

%3CLINGO-SUB%20id%3D%22lingo-sub-1181099%22%20slang%3D%22en-US%22%3EAudit%20log%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1181099%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20created%20hold%20for%20SharePoint%20sites%20and%20OneDrive%20of%20all%20users.%20When%20searching%20for%20audit%20logs%20getting%20below%20results.%20Can%20any%20one%20knows%20what%20exactly%20this%20activity%20means%3F%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22SPLog.PNG%22%20style%3D%22width%3A%20719px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F171933i6EAD294E679B2B11%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22SPLog.PNG%22%20alt%3D%22SPLog.PNG%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ODLog.PNG%22%20style%3D%22width%3A%20735px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F171934i5995274B9D921A1C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22ODLog.PNG%22%20alt%3D%22ODLog.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1181099%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1181371%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20log%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1181371%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20means%20that%20someone%20(an%20SC%20admin)%20accessed%20a%20file%20inside%20the%20preservation%20hold%20library%2C%20nothing%20more.%20There's%20a%20detailed%20description%20of%20events%20and%20their%20corresponding%20properties%20in%20the%20documentation%2C%20if%20you%20want%20to%20dissect%20all%20the%20individual%20fields.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

We have created hold for SharePoint sites and OneDrive of all users. When searching for audit logs getting below results. Can any one knows what exactly this activity means?

 

SPLog.PNGODLog.PNG

 

 

1 Reply

It means that someone (an SC admin) accessed a file inside the preservation hold library, nothing more. There's a detailed description of events and their corresponding properties in the documentation, if you want to dissect all the individual fields.