SharePoint TSV Log File

The TSV log file format is used to send SharePoint activity monitoring data to Enterprise Auditor v10.0 and earlier consoles. The following information lists all of the columns generated by SharePoint Activity Monitor into a TSV log file:

Column Name	Description
Operation Time	Date timestamp of the event in UTC time
Host	Host name of the monitored device as entered by the user
UserSid/Uid	Unique identifier for the SharePoint user: - For CIFS activity – user SID - For NFS activity – UID
User Name	SharePoint user name
UserID	ID of the SharePoint user
UserLogin	Identity claims using encoding format for user login
Path	Truncated path where the event took place, e.g. sites/TestSite/Shared Documents/Testing.txt
Protocol	Protocol of the event
FullPath	Full path where the event took place, e.g. http://sharepoint.local/sites/TestSite/Shared Documents/Testing.txt
WebApplication	Title of the SharePoint web application
SiteId	ID of the site collection
SiteUrl	URL of the site collection
WebTitle	Title of the site collection
DocLocation	Location of the document
ItemID	ID of the item
ItemTitle	Title of the item
Item Type	Type of item
EventType	Type of SharePoint event
EventSource	Source where the event came from
LocationType	Location type of the SharePoint document location
AppPrincipalId	Application principal ID
SourceName	Name of the source
EventData	Raw event data
Param	Parameters for the event