Tuesday, February 18, 2014

Very high opening/viewing numbers in audit log

I recently had an issue where I was seeing crazy numbers of downloads from a document library in the site collection audit logs - 20k downloads from one user across a two day period when the library only contained 300 documents. The culprit? Outlook. Any client that allows a user to sync the contents of a document library, will write entries into the audit log every time a sync occurs. Outlook is one application that most users have that will allow syncing offline. This is initiated via a button in the Ribbon of the document library:

image

 

 

 

Fortunately there’s a workaround. In the Advanced Settings of the document library, there’s an option to prevent offline clients from syncing content from the library:

image

If you make this change to a library:

  • New connections to the library can still be created by clicking “Connect to Outlook” but the sync will never succeed
  • Existing connections will still exist in Outlook but attempts to sync will fail:image
    • This message only briefly appears on-screen when you manually do a “Send / Receive”
    • When “Send / Receive” is done in the background, the user is not warned with the above message
    • There is also no visual indication that the syncing of a library no longer occurs which may or may not be a good thing

I also tested this with Colligo Email Manager, and unfortunately changing the “Offline Client Availability” has no effect – Colligo could still sync the contents of the library offline.