LOGbinder for SharePoint by default makes
every effort to fully translate and enrich SharePoint audit events through so
called "lookups" where-in LOGbinder makes extra queries to SharePoint
to obtain this information. But there is
a cost/benefit relationship to be considered.
Some events in the native SharePoint audit log include fields that are
of low or no value to end users at many organizations. Each field in the native log, including these
low or no value fields, requires a lookup by LOGbinder to resolve the native
SharePoint data in to user friendly data.
For example, below is a sample of LOGbinder
for SharePoint event ID 13:
Document checked in
Occurred: 6/25/2016 1:13:04 PM
Site: http://sp2010-sp
User: Administrator
Object
URL:
Shared Documents/FinancialData.xlsx
Title: n/a
Version: 1.0
As you can see in the above event, the
“Title” field returned from SharePoint is “n/a”. This is obviously of no value to the end
user. Since SharePoint includes these
low/no value fields, LOGbinder for SharePoint includes an option to
intelligently restrict the number of lookups it processes resulting in
increased performance of LOGbinder. You
can manage the amount of SharePoint lookups by opening the LOGbinder Control
Panel selecting File and then Options. The
amount of lookups performed by LOGbinder can be customized by choosing a value under
“Amount of SharePoint lookups.” See
figure 1 below.
Figure 1:
Managing the amount of SharePoint lookups
The fields that are affected (with the
exception of the “Restrict all lookups option”) are all child fields of the
targeted object. “URL” is the most important field included in the events and that
field is always reported except on some permission change events and only if
the “Exclude high/medium-cost” option is selected.
Most organizations who need to speed up LOGbinder can safely use
the “Exclude high-cost lookups” option without losing significant audit
information. Please note that the “Exclude high/medium-cost” option does
adversely impact permission change events.
We have created a document that explains outlines which fields are affected depending on which option is selected when managing the amount of SharePoint lookups. You can find a link to the document on the LOGbinder for SharePoint resources page or by clicking here.