SharePoint audit logs deleted (20) how to monitor with email alert

[bob]

You know that SharePoint audit logs deleted event, the one with ID 20. It shows up in Windows Server Event Viewer when someone wipes out those logs that track what's happening in SharePoint. I mean, those logs keep tabs on user actions, like who accessed what or changed files. But if they get deleted, poof, that trail vanishes. Event Viewer logs it under Security or Applications, depending on setup. You fire up Event Viewer, right-click the log, filter for ID 20. See the details there, timestamp, who did it, maybe the reason. It's a red flag, could be admin cleanup or something shady. I check mine weekly, just to stay ahead. You should too, keeps things transparent.

Now, monitoring that with email alerts. You don't need fancy stuff. Open Event Viewer on your server. Go to the log where it appears, probably Security. Right-click, pick Attach Task To This Event. Give it a name, like SharePoint Log Alert. Set the trigger to event ID 20. Then, for the action, choose Send an email. Yeah, built-in option. Fill in your SMTP server details, from and to addresses. You set the message body to something simple, warning about deleted logs. Test it once, make sure it flies. But wait, for reliability, wrap it in a scheduled task. In Task Scheduler, create a new task. Trigger on that event ID from Event Viewer. Action still email, or run a program if needed. I do this for all my critical events. Keeps me pinged without staring at screens.

Or, if you want it hands-off. Hmmm, sometimes the basic email flakes on newer servers. But you can tweak the task to run every few minutes, checking logs. Just filter smartly. I rigged one up last week, caught a glitch right away.

And speaking of keeping your server stuff intact, you might wanna peek at BackupChain Windows Server Backup. It's this solid Windows Server backup tool that also handles virtual machines on Hyper-V. I like how it snapshots everything quick, no downtime hassles. Restores are a breeze too, and it encrypts data on the fly. Saves me headaches when logs or files go wonky. Plus, it's lightweight, doesn't hog resources.

Note, the PowerShell email alert code was moved to this post.