SharePoint Audit Log Event ID 49

SourceSharePoint (LOGbinder SP)
Audit FlagView
Windows Security Log
 • Subcategory
Object Access
 • Application Generated
Type Success

49: List viewed

This is an event from SharePoint audit event from LOGbinder SP generated by Audit Flag  View.

On this page

This event is generated when a document list is viewed (if auditing is selected for that object)

List/library-level audit policy is extremely important when it comes to auditing who is viewing confidential information. If you enable View auditing at the site collection level you end up generating events for every page click by every user througout the entire site collection which will create a load on resources and storage.

Free Security Log Resources by Randy

Description Fields in 49

  • Occurred: this is the date and time when SharePoint recorded the event to the internal SharePoint audit log and may be earlier than the date/time in the header of this event which reflects when LOGbinder SP wrote the event to Windows event log
  • Site: This is the URL of the site generating this event
  • User: name of the user who performed the action
  • Object
    • Type: type of list that was viewed
    • URL: URL of the object targeted by this operation
    • Title: title of the object targeted by this operation
    • Description: this is the description that appears on the page


Supercharger Free Edition


Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 49

List viewed
Occurred: 11/22/2011 1:13:04 AM
Site: http://sp2010-sp
User: System Account
  Type: Generic List
  URL: /Lists/My List/AllItems.aspx
  Title: My List
  Description: this is my list

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources