SharePoint Audit flag mapping

Last week I was asked to enabling Auditing for delete in all our sites in our farm.  When I first iterated all the sites to check what values that already was there I got responses back like 584 and I was not sure how it all worked. Google helped me a bit on the way to find an answer.

SharePoint stores the auditflags in decimal form but they are made up from binary values.

List of Auditflags in SharePoint 2010:

SPauditMaskType Value
All -1
CheckIn 2
CheckOut 1
ChildDelete 64
Copy 2048
Delete 8
Move 4096
None 0
ProfileChange 32
SchemaChange 128
Search 8192
SecurityChange 256
Undelete 512
Update 16
View 4
Workflow 1024

Event to audit options in SharePoint interface

Documents and Items

Opening or downloading documents, viewing items in lists, or viewing item properties 4
Editing Items 16
Checking out or Checking in items 1,2
Moving or copying items to another location in the site 4096,2048
Deleting or restoring items 8,64,512

List,Libraries and Sites

Editing content types and columns 32,128
Searching site content 8192
Editing user and permission 256

This is provided as is.


About tomasnorin

I’m a developer that’s been working with web development for some 20 years. I have mostly been working with Microsoft Technologies
This entry was posted in SharePoint and tagged , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s