You can use the audit log reports provided with SharePoint to view the data in the audit logs for a site collection. You can sort, filter, and analyze this data to determine who has done what with sites, lists, libraries, content types, list items, and library files in the site collection. For example, you can determine who deleted which content.

Knowing who is taking what action on which content in your site collection can be critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management. You save an audit log report as a Microsoft Excel 2013 Preview workbook to a library in the site collection that you specify.

Note:  Auditing must be enabled to use audit log reports. Find more information about enabling auditing in Configure audit settings for a site collection.

Note: Pages, such as .aspx, aren't considered documents so they can't be audited in SharePoint Server 2016.

The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection:

Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint sites)

Edited items

Checked out and checked in items

Items that have been moved and copied to other location in the site collection

Deleted and restored items

Changes to content types and columns

Search queries

Changes to user accounts and permissions

Changed audit settings and deleted audit log events

Workflow events

Custom events

You can use the following audit log reports provided with SharePoint to help determine who is taking what actions with the content of a site collection:

Content viewing    Reports users who have viewed content on a site. In SharePoint, this report will be blank as these events are not captured during auditing.

Content modifications    Reports changes to content, such as modifying, deleting, and checking documents in and out.

Deletion    Reports what content has been deleted.

Content type and list modifications    Reports additions, edits, and deletions to content types.

Policy modifications    Reports on events that change the information management policies on the site collection.

Expiration and Disposition    Reports all events related to how content is removed when it expires.

Auditing settings    Reports changes to the auditing settings.

Security settings    Reports changes to security settings, such as user/group events, and role and rights events.

Run a custom report    You can specify the filters for a custom report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.

Following is a sample Deletion audit log report. It is representative of the other audit log reports.

A summary of the audit data is provided as a PivotTable on the Audit Data – Table worksheet of the workbook.

The data for the report is provided on the Report Data 1 worksheet of the workbook.

To view an audit log report:

Click Settings , and then click Site settings.

Click Audit log reports in the Site Collection Administration section.

Select the report that you want, such as Deletion on the View Auditing Reports page, .

Type a URL or Browse to the library where you want to save the report and then click OK.

On the Operation Completed Successfully page, click click here to view this report. If you get an error, it may be because audit logs weren't enabled or there was no data to show. See Configure audit settings for a site collection to be sure event logging is set up.

Notes: 

At least Excel version 2013 must be installed to view audit log reports by clicking click here to view this report.

Alternatively, if opening documents in the browser is enabled for the library, go to the library where you saved the audit log report, point to the audit log report, click the down arrow, and then click View in Browser.

You can use standard Excel features to narrow the reports to the information you want. Some ways in which you can analyze and view the log data include:

Filtering the audit log report for a specific site.

Filtering the audit log report for a particular date range.

Sorting the audit log report.

Determining who has updated content.

Determining which content has been deleted but not restored.

Viewing the changes to permissions on an item.

Configure audit settings for a site collection