Turning SharePoint SPAuditEntry Update into Create

If you’ve done any work with SharePoint and SPAuditEntry, you may have noticed the distinct lack of Create event. Instead, two Update events are created which means some extra processing is required.

For example, after uploading “NewTxtFile.txt” into a document library inside one of my sites, the following Audit Entries showed up.

Notice the “Occurred” DateTime properties are the same as well the Event. Also, one is an Update for the List and one is an Update for the Document. Using this information, you can then simplify the duplicate Update events into one Create event!

Update 08/18/2010:

Looks like Thomas found an easier method for determing Create events! I did some more research after seeing his comment and found the following:

1. Creates:
   • Document Audit Entry: EventData is null
   • List Audit Entry: EventData contains document filename
2. Edits:
   • Document Audit Entry: EventData contains version information

Here are the two events generated during a Create:

Here is the event that was generated after an Edit:

Thanks Thomas!

• SharePoint 2007