PoshCode Logo PowerShell Code Repository

Log 4 SP easy restore by cglessner 21 months ago (modification of post by cglessner view diff)
diff | embed code: <script type="text/javascript" src="http://PoshCode.org/embed/1799"></script>download | new post

Log SharePoint content deletions in all sites fora specified web application. Motivation was to determine content deletion dates to easily find the right backup for a selective restore.

  1. ####### Log deletions in all sites in a web application ######
  2.  
  3. ############# http://iLoveSharePoint.com ##################
  4. ############## by Christian Glessner ######################
  5.  
  6. ################ begin config #################
  7.  
  8. # Url of the web application to audit. Don't forget to activate the delete audit log on sites you want to log.
  9. $targetWebAppUrl = "http://localhost:100"
  10.  
  11. # Url of the web that contains the list to log (list must contains the following columns: "Title" (text), "Event Url" (Url), "Item Type" (text), "Event" (text), "Occurred" (DateTime), "User" (text)"
  12. $logWebUrl = "http://localhost:100"
  13.  
  14. # Title of the log list
  15. $logListTitle ="Audit"
  16.  
  17. ################# end config ##################
  18.  
  19. $lastRunPropName = "_iLSP_lastAuditTimestamp"
  20.  
  21. [void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SharePoint')
  22.  
  23. $logSite = New-Object Microsoft.SharePoint.SPSite($logWebUrl)
  24. $logWeb = $logSite.OpenWeb()
  25. $logList = $logWeb.Lists[$logListTitle]
  26.  
  27. $targetWebApp = [Microsoft.SharePoint.Administration.SPWebApplication]::Lookup($(New-Object Uri($targetWebAppUrl)))
  28.  
  29. if($targetWebApp.Properties.ContainsKey($lastRunPropName) -eq $false)
  30. {
  31.         $targetWebApp.Properties[$lastRunPropName] = [DateTime]::MinValue
  32.         $targetWebApp.Update()
  33. }
  34.  
  35. $lastRun = [DateTime]::Parse($targetWebApp.Properties[$lastRunPropName].ToString())
  36. $newRun = [DateTime]::Now.ToUniversalTime()
  37.  
  38. foreach($site in $targetWebApp.Sites)
  39. {      
  40.         $query = New-Object Microsoft.SharePoint.SPAuditQuery($site)
  41.         $query.AddEventRestriction([Microsoft.SharePoint.SPAuditEventType]::Delete)
  42.         $query.SetRangeStart($lastRun)
  43.         $query.SetRangeEnd($newRun.AddDays(1))
  44.        
  45.         $result = $site.Audit.GetEntries($query)
  46.        
  47.         if($result.Count -gt 0)
  48.         {
  49.                 foreach($entry in $result)
  50.                 {
  51.                         $eventUrl = $site.Url + "/" + $entry.DocLocation
  52.                        
  53.                         $item = $logList.Items.Add()
  54.                         $item[[Microsoft.SharePoint.SPBuiltInFieldId]::Title] = $entry.DocLocation
  55.                         $item["Event Url"] = $eventUrl
  56.                         $item["Item Type"] = $entry.ItemType
  57.                         $item["Event"] = $entry.Event
  58.                         $item["Occurred"] = $entry.Occurred.ToLocalTime()
  59.                         $item["User"] = $logWeb.SiteUsers.GetByID($entry.UserId).LoginName
  60.                         $item.Update()
  61.                        
  62.                 }
  63.         }
  64.        
  65.         $site.Dispose()
  66. }
  67.  
  68. $targetWebApp.Properties[$lastRunPropName] = $newRun
  69. $targetWebApp.Update()
  70.  
  71. $logWeb.Dispose()
  72. $logSite.Dispose()

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:


Remember me