SharePoint Audit Policy: Delete

These audit flags correspond to the "Deleting or restoring items" check box on the "Site collection audit settings" page in Site Collection Administration.

These 3 audit flags allow you to track when objects are deleted. If you enable both flags you will get 2 events whenever an object is deleted. For list items deleted, the parent identified in the ChildDelete event will be the list. If the list itself is deleted the parent is the Web object where the list resides.

The only difference between these 2 flags and their events are that

  1. The ChildDelete event shows the View that was displayed from which the user deleted a list item or document.
  2. ChildDelete is a bit clearer on the parent object.
  3. The Delete object shows Recycled information.
  4. When you delete a site from a site collection, SharePoint logs a Delete event but no ChildDelete event.

Audit Flag

Event ID by LOGbinder for SharePoint

ChildDelete

15 - Child object deleted

Delete

19 - Object deleted

Undelete

39 - Object restored

 

Upcoming Webinars
    Additional Resources