Hi, I need to keep track of the documents that are being opened from specific library due to their sensitive nature, so after checking that the Reporting feature was enabled, I enabled the View/Open event at library level, but I was not getting data. I followed this old article.
https://www.ultimatewindowssecurity.com/sharepoint/auditpolicy/view/granular.aspx
I only started getting data when I enabled the audit at site level, but then I'm getting the audit information for all the site, not for only the library. Am I missing something? Is there any delay for the audit information when enabled only at list/library level?
