While fetching the Audit Log Programmatically, last Downloaded document is not fetched from Auditing Log

Issue: While fetching the Audit Log using API, Recently Downloaded Document is not retrieved from Audit Log

Configuration : Auditing enabled to "Viewing or Downloading Documents" at Site Collection Level

Below Code Used to Fetch the last 30 minutes of Audit Log

SPList list = web.Lists["MyLibrary"];
SPAuditQuery wssQuery = new SPAuditQuery(SPContext.Current.Web.Site);
wssQuery.SetRangeStart(DateTime.Now.AddMinutes(-30)); // To get the last 30 Mins of data
SPAuditEntryCollection auditCol = SPContext.Current.Web.Site.Audit.GetEntries(wssQuery); 

Steps to replicate the issue:

1. Download 3 documents sequentially
Pause for 15 seconds
2. Download next 2 documents sequentially
3. Execute above mentioned program
Result : Fetched only first 3 documents, documents which are downloaded after pause is not retrieved
4. Do Page Refresh
Result : I can See 5 Documents

Question :

Is Most recent download event pushed into Content DB by other relevant event ?? (Event : Page Refresh /New Download / Custom Report Generation etc ).

Page Refresh : Creates a view entry to Audit Log, So It pushes the Last download Event
New Download : Creates a view entry to Audit Log, So It pushes the Last download Event
Custom Report Generation : Creates a view entry to Audit Log, So It pushes the Last download Event

What is the solution to fetch all downloaded events through SPAudit Class?

  • Edited by Venkadesh S Thursday, January 09, 2014 12:33 PM
January 9th, 2014 1:49pm


I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

Best regards

Free Windows Admin Tool Kit Click here and download it now
January 10th, 2014 11:16am

Hi Venkadesh S,

i saw your other thread at: http://social.technet.microsoft.com/Forums/en-US/a62113cf-9833-4615-a8e7-71e7123f1cd4/while-fetching-the-audit-log-programmatically-last-downloaded-document-is-not-fetched-from-auditing?forum=sharepointgeneralprevious

if i may ask, if you wait about 3 minutes before fetching the information, do all the information will be shown correctly?

i don't think the audit log, have 'cache' also, because, for example, when you refresh the page then the data is updated, so i am wonder if should there is a lag or bottle neck, that causing this.

as i tried in my environment seems ok, or it is because the data is not that many.

January 10th, 2014 2:22pm

Hi Aries, 

In other thread, i mentioned like.. "if i wait for 10 mins then i can read the data" - This is my wrong observation. Actual Fact is, in this mean time, without my knowledge i refreshed a page or something. That gave me a correct output.

I corrected this in the same thread and Issue posted in this thread also correct.

For your question,

waiting time is not a matter. If i download 5 docs sequentially then through API i can read only 4 entries.

sorry for the confusion. Waiting time i mentioned here is to reproduce the issue without any trouble.

Did you followed the same steps to reproduce the issue? please make sure you didn't made any page refresh after the last event.

Also did you used API to read the data ?

Free Windows Admin Tool Kit Click here and download it now
January 10th, 2014 2:47pm

Hi Venkadesh,

I am using visual studio.

if based from your research, is it possible if you add a command to refresh the page first then call the request?

such as: 

January 10th, 2014 3:22pm

Hi Aries,

My code is part of custom SharePoint web service. So i can't use location.reload(true).

Just want to know, Can you reproduce this issue ? 

Free Windows Admin Tool Kit Click here and download it now
January 10th, 2014 3:43pm

Hi Venkadesh,

terribly sorry, but i cant reproduce the same result as yours.

i will try to do some research over weekend, and will post the result after the search.

just got curious,

if you populate for each of the item first, will it give the same result.





January 10th, 2014 4:21pm

Hi Aries,

Thanks for your effort !

You can also replicate the issue by below steps

1. Keep your Visual Studio and Browser side by Side

2. Open your library and Download 3 documents sequentially

(No Page Refresh)

3. Goto VisualStudio and run the program

Result : In my case it shows only 2 View Events

4. Open your library and Do F5

Result : In my case it shows 3 View Events

Free Windows Admin Tool Kit Click here and download it now
January 10th, 2014 4:41pm

I started believe that it's an bug in the Windows SharePoint Services 3.0.

Can i report this to Microsoft ? If yes, which is the right way to approach?

January 13th, 2014 4:17am

Hi Venkadesh,

sorry for the late reply,

at this moment, i am checking for the timer job that run in the web application or site,

i found an example, that perhaps there are some timer job that is run from the site collection itself then trigger to execute the update, for example:

using (SPSite site = new SPSite("site")){
foreach (SPJobDefinition job in site.WebApplication.JobDefinitions)
   if (job.Name == "Timerjobname"){

because at my environment the data is not that much and the timer job is not having huge load, so it may quicker in someway. for the timer job that start from the site usually, it will be trigger by minutes, and it will need to wait for some moment until the process to be done. so in some environment the time consumption may be vary, from 3~10 minutes about.

if you need to submit this issue to us, and have a report if it should be an issue, please contact our customer care, http://support.microsoft.com/contactus/, so that you may have a ticket number and you can follow up your issue with the ticket number in the future.

Free Windows Admin Tool Kit Click here and download it now
January 13th, 2014 4:37am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics