SharePoint Audit Log Event ID 48

SourceSharePoint (LOGbinder SP)
Audit FlagView
Windows Security Log
Category
 • Subcategory
Object Access
 • Application Generated
Type Success
Discussions on Event ID 48
Ask a question about this event

48: Document library viewed

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  View.

On this page

This event is produced when a document library is viewed.

List/library-level audit policy is extremely important when it comes to auditing who is viewing confidential information. If you enable View auditing at the site collection level you end up generating events for every page click by every user througout the entire site collection which will create a load on resources and storage. We recommend limiting auditing to only what is needed.

Free Security Log Resources by Randy

Description Fields in 48

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Object
    • URL: URL of the object targeted by this operation
    • Title: title of the object targeted by this operation
    • Description: this is the description that appears on the page

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 48

Document library viewed
Occurred: 11/20/2011 5:55:56 PM
Site: http://sp2010-sp
User: System Account
Object
  URL: /SitePages/Forms/AllPages.aspx
  Title: Site Pages
  Description: Use this library to create and store pages on this site.

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources