At some point in time we might have ended up or will end up in a situation like this in Office 365, where in a site collection where Auditing is enabled but still in the report nothing shows up.
In my case I did had a site collection in which I have enabled Auditing on September and by October 1 I couldn’t see the data for September… It looks 2 days for me to identify what have gone wrong!!!
Here are my findings
· We confirmed that we could generate audit log reports in site collection on any date after 1st of October
· The above behaviour is seen since the logs gets deleted after each month if “Automatically trim the audit log for this site?" is set to No.
Background
The behaviour is expected, this means the default setting for retaining audit log data is zero days. That means if you don’t specify a different retention period, all audit log entries are deleted at the end of the month. Please refer
· We changed the “Automatically trim the audit log for this site?" to yes and number of days to be retained would be 100 now.
MS as enabled to pull the audit report from security and compliance portal too.
At a very high level, you can use the Reports page in the Office 365 Security & Compliance Centre to quickly access audit reports for your SharePoint Online and Exchange Online organizations. Please refer
Leave a comment