SharePoint JSON Log File
Use the JSON log file format to send SharePoint activity monitoring data to Access Analyzer v10.0 consoles. The following lists all attributes that SharePoint Activity Monitor generates into a JSON log file:
| Attribute Name | Description | Example |
|---|---|---|
| TimeLogged | DateTime/ string | 2019-03-14T18:13:39.00Z |
| ActivityType | Constant “SharePoint” | SharePoint |
| AgentHost | Host name where agent is installed | sphost |
| UserSid | The SID of the user who triggered the event | S-1-0-0 |
| UserName | The name of the user who triggered the event | System Account |
| UserID | The ID of the user who triggered the event | 1073741823 |
| UserLogin | The login name of the user who triggered the event | SHAREPOINT\system |
| Protocol | Protocol: HTTP / HTTPS.. | HTTP |
| AbsoluteUrl | Full Url: SiteUrl + DocLocation | http://sphost/Lists/Comments/1\_.000 |
| WebApplication | Web application name | SharePoint – 80 |
| SiteId | Site Id (guid) | 7b2c8d23-a74f-4c3c-985d-2c7facb5ebae |
| SiteUrl | Site Url | http://sphost/sites/mysite |
| WebTitle | Web title | my site |
| DocLocation | Location of an audited object at the time of the audited event | Lists/Comments/1_.000 |
| ItemId | The GUID of the object that the entry represents | 2c4174dc-322d-47bc-a420-52968fc3ba6c |
| ItemTitle | Title of the object | Welcome to my blog! |
| ItemType | Type of the object: Document / ListItem / List / Folder / Web / Site | ListItem |
| EventType | An SPAuditEventType that represents the type of event | Update |
| EventSource | A value that indicates whether the event occurred as a result of user action in the SharePoint Foundation user interface (UI) or programmatically. Values: SharePoint / ObjectModel | SharePoint |
| LocationType | Specifies the actual location of a document in a SharePoint document library: Invalid, Url, ClientLocation | Url |
| AppPrincipalId | The ID of the app principal that triggered the event. If EventSource has the value ObjectModel, AppPrincipalId holds the ID of the app principal whose context ran the code that triggered the event. If no app context exists, AppPrincipalId is null. | 0 |
| SourceName | The name of the application that caused the event | <empty> |
| RawEventData | A String that holds XML markup providing data that is specific to the type of event that the entry object represents. | <RelatedItem><Id>06C49477-0498-4858-900C-45B595337462</Id><Relationship><NewName> MyDocs/myfile.zip</NewName></RelatedItem |
| AuditMask | The new audit mask | [“CheckIn”,“View”,“Delete”,“Update”] |
| ChildId | The GUID of the child item that you deleted or moved | 06C49477-0498-4858-900C-45B595337462 |
| ChildDocLocation | The pre-deletion URL of the child item | Lists/Posts/2_.000 |
| NewDocLocation | The URL to which you moved the item | MyNewDocs/myfile.zip |
| Version | The new version of the document / The version that was deleted | 1.0 |
| DeleteType | Whether you moved it to the recycle bin (1) or deleted it completely (0). 1 - MovedToRecycle; 0 - DeletedCompletely | MovedToRecycle |
| SearchQuery | myfile | |
| SearchConstraint | site:“http://sphost/sites/mysite” | |
| GroupId | The ID of the new/deleted group The ID of the group that was bound to the role | 11 |
| GroupName | The name of the new/deleted group The name of the group that was bound to the role | My Super Group |
| TrusteeId | The ID of the user that was added/deleted from the group The ID of the user that was bound to the role | 8 |
| TrusteeName | The Name of the user/group that was added/deleted from the group The Name of the user/group that was bound to the role | spuser |
| TrusteeType | Indicates whether this entry represents a group or a user: User / Group | User |
| UpdateType | Added or Removed | Added, Removed, or Updated |
| RoleId | The ID of the new/changed/deleted permission level | 1073741924 |
| RoleName | The name of the new/changed/deleted permission level | My Role |
| Permissions | The combination of permissions | [“ViewListItems”,“AddListItems”,“EditListItems”] |