On-premises Sharepoint Foundation 2013 farm, with third-party forms-based authentication.
Multiple users on multiple site collections are reporting that large numbers of files will suddenly disappear from document libraries and appear in the recycle bin, despite no user action to delete them. I normally wouldn't believe the end user, but there have been too many reports, including instances where the logs report a deletion tied to a user account while that user's machine was undergoing maintenance and didn't even have a functional Windows install.
Unfortunately, I can't reproduce this on demand, because it appears to happen at random, and with different user accounts, in different libraries, sometimes a file here or there, sometimes whole folders at a time.
I can, however, find parts of the ULS logs which correspond to the file deletions. So my question is - what produces these types of log entries? What program sends these sort of SOAP requests with Cmd="Delete"? Can this be narrowed down to a browser, or OneDrive for Business, or some other way of interacting with the site? Can the log entries exclude anything from consideration?
All the log entries for these deletions look similar - an authentication request that matches the user that the recycle bin says did the deletion, and then one or more SOAP-based requests to delete the files. Log excerpt follows, formatted slightly for readability:
******************
09/09/2015 14:22:10.13 w3wp.exe (0x22D4) 0x14B8 SharePoint Foundation Logging Correlation Data xmnv Medium Name=Request (POST:http://sample.company.com/_vti_bin/Lists.asmx:UpdateListItemsWithKnowledge) 4c582c9d-72cd-202d-ca0b-a7993bff1156
09/09/2015 14:22:10.13 w3wp.exe (0x22D4)
0x14B8
SharePoint Foundation Authentication Authorization
agb9s Medium
Non-OAuth request. IsAuthenticated=True, UserIdentityName=0#.f|ldapmember|example@company.com, ClaimsCount=14
4c582c9d-72cd-202d-ca0b-a7993bff1156
09/09/2015 14:22:10.22 w3wp.exe (0x22D4)
0x14B8
SharePoint Foundation Asp Runtime
aj1km High
[Forced due to logging gap, cached @ 09/09/2015 14:22:10.13, Original Level: Verbose] SPRequestModule.PostResolveRequestCacheHandler
4c582c9d-72cd-202d-ca0b-a7993bff1156
09/09/2015 14:22:10.22 w3wp.exe (0x22D4)
0x14B8
SharePoint Foundation Asp Runtime
aj1kn High
[Forced due to logging gap, Original Level: Verbose] SPRequestModule.AcquireRequestStateHandler
4c582c9d-72cd-202d-ca0b-a7993bff1156
09/09/2015 14:22:10.23 w3wp.exe (0x22D4)
0x14B8
SharePoint Foundation General
fbv5 Medium
SoapAction: http://schemas.microsoft.com/sharepoint/soap/UpdateListItemsWithKnowledge
4c582c9d-72cd-202d-ca0b-a7993bff1156
09/09/2015 14:22:10.23 w3wp.exe (0x22D4)
0x14B8
SharePoint Foundation General
fbv6 Medium
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body>
<UpdateListItemsWithKnowledge xmlns="http://schemas.microsoft.com/sharepoint/soap/">
<listName>{86C43956-4D87-4109-BB94-251DFF22ED5E}</listName>
<updates>
<Batch OnError="Continue" PreCalc="TRUE" DateInUtc="TRUE">
<Method Cmd="Delete" ID="1">
<Field Name="ID">2463</Field>
<Field Name="ows_owshiddenversion">1</Field>
<Field Name="FileRef">http://sample.company.com/Folder/Subfolder/Example.docx</Field>
</Method>
Etc...
************************
Any information whatsoever about what these log entries mean (or how it's even possible that Sharepoint could delete a file without direct user intervention) would be very appreciated.