Turning SharePoint SPAuditEntry Update into Create
January 22nd, 2010
If you’ve done any work with SharePoint and SPAuditEntry, you may have noticed the distinct lack of Create event. Instead, two Update events are created which means some extra processing is required.
For example, after uploading “NewTxtFile.txt” into a document library inside one of my sites, the following Audit Entries showed up.
<SiteId>9a70a244-1baa-4229-84ac-3f06bccecc7f</SiteId>
<ItemId>f332a82b-17d1-4c31-9726-5259769f2695</ItemId>
<ItemType>List</ItemType>
<UserId>2</UserId>
<DocLocation>sites/MySiteCollection/MySubsite/Documents</DocLocation>
<LocationType>Url</LocationType>
<Occurred>1/22/2010 9:17:06 PM</Occurred>
<Event>Update</Event>
<EventSource>SharePoint</EventSource>
<EventData>NewTxtFile.txt</EventData>
</AuditEntry>
<AuditEntry>
<SiteId>9a70a244-1baa-4229-84ac-3f06bccecc7f</SiteId>
<ItemId>19ce9254-93bc-41ff-9da1-ba5e994bf1c1</ItemId>
<ItemType>Document</ItemType>
<UserId>2</UserId>
<DocLocation>sites/MySiteCollection/MySubsite/Documents/NewTxtFile.txt</DocLocation>
<LocationType>Url</LocationType>
<Occurred>1/22/2010 9:17:06 PM</Occurred>
<Event>Update</Event>
<EventSource>SharePoint</EventSource>
</AuditEntry>
Notice the “Occurred” DateTime properties are the same as well the Event. Also, one is an Update for the List and one is an Update for the Document. Using this information, you can then simplify the duplicate Update events into one Create event!
Update 08/18/2010:
Looks like Thomas found an easier method for determing Create events! I did some more research after seeing his comment and found the following:
- Creates:
- Document Audit Entry: EventData is null
- List Audit Entry: EventData contains document filename
- Edits:
- Document Audit Entry: EventData contains version information
Here are the two events generated during a Create:
<SiteId>9a70a244-1baa-4229-84ac-3f06bccecc7f</SiteId>
<ItemId>ca98cdba-c44f-4318-bb44-a46bd674d80f</ItemId>
<ItemType>Document</ItemType>
<UserId>19</UserId>
<DocLocation>sites/MySiteCollection/MySubsite/Documents/Test Document.doc</DocLocation>
<LocationType>Url</LocationType>
<Occurred>8/18/2010 2:21:43 PM</Occurred>
<Event>Update</Event>
<EventSource>SharePoint</EventSource>
</AuditEntry>
<AuditEntry>
<SiteId>9a70a244-1baa-4229-84ac-3f06bccecc7f</SiteId>
<ItemId>28efdcba-4639-445f-80b6-31964a9f95f1</ItemId>
<ItemType>List</ItemType>
<UserId>19</UserId>
<DocLocation>sites/MySiteCollection/MySubsite/Documents</DocLocation>
<LocationType>Url</LocationType>
<Occurred>8/18/2010 2:21:43 PM</Occurred>
<Event>Update</Event>
<EventSource>SharePoint</EventSource>
<EventData>Test Document.doc</EventData>
</AuditEntry>
Here is the event that was generated after an Edit:
<SiteId>9a70a244-1baa-4229-84ac-3f06bccecc7f</SiteId>
<ItemId>ca98cdba-c44f-4318-bb44-a46bd674d80f</ItemId>
<ItemType>Document</ItemType>
<UserId>19</UserId>
<DocLocation>sites/MySiteCollection/MySubsite/Documents/Test Document.doc</DocLocation>
<LocationType>Url</LocationType>
<Occurred>8/18/2010 2:25:47 PM</Occurred>
<Event>Update</Event>
<EventSource>SharePoint</EventSource>
<EventData>
<Version>
<Major>1</Major>
<Minor>0</Minor>
</Version>
</EventData>
</AuditEntry>
Thanks Thomas!
August 18th, 2010 at 1:27 am
Uhm… I’m just starting out with sharepoint, and I realize this is an old blog entry, but wouldn’t you be able to tell it’s a create from the eventData? Afaik, it’s only ‘creates’ that contain the filename in eventdata?
August 18th, 2010 at 9:41 am
Thomas,
It looks like you are right about the EventData property! I updated my post with more information.
Thanks,
Kit