SharePoint Audit Policy: Custom

Custom is not actually an audit flag you can enable. It simply corresponds to events that are logged by a SharePoint application rather than the SharePoint system itself. LOGbinder for SharePoint logs several custom security events such as those listed below regarding audit trail integrity. Any event LOGbinder does not recognize will be recorded as event ID 18. There are some undocumented events logged by the SharePoint system and LOGbinder reports these using event ID 18 until if and when LOGbinder development assigns them a new event ID.

Audit Flag

Event ID by LOGbinder for SharePoint

Custom

18 - Custom event

Custom

60 - Possible tampering warning

Custom

61 - Retention policy processed

 

Upcoming Webinars
    Additional Resources