Missing Audit Log Data

%3CLINGO-SUB%20id%3D%22lingo-sub-818204%22%20slang%3D%22en-US%22%3EMissing%20Audit%20Log%20Data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-818204%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20a%20list%20in%20SPO%20site%20that%20has%20many%20items%20added%20every%20week.%20The%20O365%20Audit%20Log%20in%20the%20Security%20and%20Compliance%20center%20is%20not%20showing%20any%20of%20the%20events%20for%20this%20list.%20Has%20anyone%20else%20noticed%20this%20type%20of%20problem%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-818204%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-819474%22%20slang%3D%22en-US%22%3ERe%3A%20Missing%20Audit%20Log%20Data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-819474%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20hardly%20the%20first%20time%20data%20is%20missing%20from%20the%20unified%20log%2C%20I%20can%20bet%20anything%20it%20wont%20be%20the%20last%20either.%20Check%20the%20SPO%20audit%20logs%20and%20open%20a%20support%20case.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-819603%22%20slang%3D%22en-US%22%3ERe%3A%20Missing%20Audit%20Log%20Data%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-819603%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1096%22%20target%3D%22_blank%22%3E%40Dean%20Gross%3C%2FA%3E%26nbsp%3B%20Do%20the%20audit%20records%20exist%20in%20the%20audit%20log%3F%20Can%20you%20find%20them%20with%20PowerShell%20if%20you%20run%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%24recs%20%3D%20search-unifiedauditlog%20-Operations%20listItemCreated%20-StartDate%201-Aug-2019%20-EndDate%2024-Aug-2019%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20point%20is%20that%20sometimes%20the%20SCC%20audit%20log%20search%20doesn't%20return%20all%20available%20data....%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Respected Contributor

We have a list in SPO site that has many items added every week. The O365 Audit Log in the Security and Compliance center is not showing any of the events for this list. Has anyone else noticed this type of problem? 

2 Replies
Highlighted

It's hardly the first time data is missing from the unified log, I can bet anything it wont be the last either. Check the SPO audit logs and open a support case.

Highlighted

@Dean Gross  Do the audit records exist in the audit log? Can you find them with PowerShell if you run 

 

$recs = search-unifiedauditlog -Operations listItemCreated -StartDate 1-Aug-2019 -EndDate 24-Aug-2019

 

The point is that sometimes the SCC audit log search doesn't return all available data....