LOGbinder SP - Unlock the SharePoint Audit Log
As more and more information and processes move to SharePoint, it becomes
critical for compliance and security requirements to monitor and audit
SharePoint activity.
I was very excited when I first learned about the SharePoint audit log but I
quickly determined that in its unimproved state the SharePoint audit log is
essentially unusable due to 4 key issues:
- SharePoint's audit log does not provide the names of users or objects. The
SharePoint audit log fails to translate record IDs, meaning you have no idea
what object or user to which a given event refers! Click here for an example of
an audit event from SharePoint and then what LOGbinder does with it.
- SharePoint's audit log is buried in SharePoint's SQL server content database. To
ensure the integrity of audit trails, logs must be moved from the system where
they are generated to separate and security log archive. However in SharePoint,
the audit log isn't really a log - it's a table in the SharePoint database. This
makes it inaccessible for most log management solutions. Without the ability to
collect the SharePoint audit log into a separate, secure log archive its value
as a high integrity audit trail is compromised.
- SharePoint's audit log has no reporting. In Windows Sharepoint Services the log
is totally inaccessible and in Office Sharepoint Services it's exposed through
through a few rudimentary, impractical reports in Excel.
- Windows SharePoint Services provides no interface for enabling auditing at all.
The audit log is there but without custom programming there's no way to turn it
on; much less access the logs.
I'm still a software developer at heart and the problems with the SharePoint
audit log finally pushed me over the edge.
The result is LOGbinder SP. LOGbinder SP is a small, efficient Windows service
that monitors the internal SharePoint audit log without making any changes to
your SharePoint installation.
For each event LOGbinder SP resolves the user and object IDs and other cryptic
codes, producing an easy to understand, plain-English translation of the
SharePoint audit event. LOGbinder SP then sends these events to the Windows
event log (either the Security log or a custom log) which in turn allows you to
leverage any log management solution to collect, monitor, alert, analyze, report
and archive SharePoint audit logs.
Click here to try out LOGbinder SP.