Sharepoint Foundation 2013 deleting files at random - help with reading ULS logs

On-premises Sharepoint Foundation 2013 farm, with third-party forms-based authentication.

Multiple users on multiple site collections are reporting that large numbers of files will suddenly disappear from document libraries and appear in the recycle bin, despite no user action to delete them. I normally wouldn't believe the end user, but there have been too many reports, including instances where the logs report a deletion tied to a user account while that user's machine was undergoing maintenance and didn't even have a functional Windows install.

Unfortunately, I can't reproduce this on demand, because it appears to happen at random, and with different user accounts, in different libraries, sometimes a file here or there, sometimes whole folders at a time.

I can, however, find parts of the ULS logs which correspond to the file deletions. So my question is - what produces these types of log entries? What program sends these sort of SOAP requests with Cmd="Delete"? Can this be narrowed down to a browser, or OneDrive for Business, or some other way of interacting with the site? Can the log entries exclude anything from consideration?

All the log entries for these deletions look similar - an authentication request that matches the user that the recycle bin says did the deletion, and then one or more SOAP-based requests to delete the files. Log excerpt follows, formatted slightly for readability:

******************

09/09/2015 14:22:10.13 w3wp.exe (0x22D4)                       0x14B8 SharePoint Foundation         Logging Correlation Data       xmnv Medium   Name=Request (POST:http://sample.company.com/_vti_bin/Lists.asmx:UpdateListItemsWithKnowledge) 4c582c9d-72cd-202d-ca0b-a7993bff1156

09/09/2015 14:22:10.13 w3wp.exe (0x22D4)                       0x14B8 SharePoint Foundation         Authentication Authorization   agb9s Medium   Non-OAuth request. IsAuthenticated=True, UserIdentityName=0#.f|ldapmember|example@company.com, ClaimsCount=14 4c582c9d-72cd-202d-ca0b-a7993bff1156

09/09/2015 14:22:10.22 w3wp.exe (0x22D4)                       0x14B8 SharePoint Foundation         Asp Runtime                   aj1km High     [Forced due to logging gap, cached @ 09/09/2015 14:22:10.13, Original Level: Verbose] SPRequestModule.PostResolveRequestCacheHandler 4c582c9d-72cd-202d-ca0b-a7993bff1156

09/09/2015 14:22:10.22 w3wp.exe (0x22D4)                       0x14B8 SharePoint Foundation         Asp Runtime                   aj1kn High     [Forced due to logging gap, Original Level: Verbose] SPRequestModule.AcquireRequestStateHandler 4c582c9d-72cd-202d-ca0b-a7993bff1156

09/09/2015 14:22:10.23 w3wp.exe (0x22D4)                       0x14B8 SharePoint Foundation         General                       fbv5 Medium   SoapAction: http://schemas.microsoft.com/sharepoint/soap/UpdateListItemsWithKnowledge 4c582c9d-72cd-202d-ca0b-a7993bff1156

09/09/2015 14:22:10.23 w3wp.exe (0x22D4)                       0x14B8 SharePoint Foundation         General                       fbv6 Medium   <?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<UpdateListItemsWithKnowledge xmlns="http://schemas.microsoft.com/sharepoint/soap/">
<listName>{86C43956-4D87-4109-BB94-251DFF22ED5E}</listName>
<updates>
<Batch OnError="Continue" PreCalc="TRUE" DateInUtc="TRUE">
<Method Cmd="Delete" ID="1">
<Field Name="ID">2463</Field>
<Field Name="ows_owshiddenversion">1</Field>
<Field Name="FileRef">http://sample.company.com/Folder/Subfolder/Example.docx</Field>
</Method>

Etc...

************************

Any information whatsoever about what these log entries mean (or how it's even possible that Sharepoint could delete a file without direct user intervention) would be very appreciated.


September 9th, 2015 11:52pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics