Showing results for 
Show  only  | Search instead for 
Did you mean: 

Microsoft Sharepoint Logs

Dear friends.

Our team has enciuntered with an issue, which is connected with sharepoint logs. What have been done:

1. Created Data Source to accept logs from Sharepoint (screenshot provided below)


2. Remotely installed SIEM Collector Application on Windows 2012 Sever and General Configuration Policy was configured (Screenshot provided)

win events.PNGGeneral Configuration For Receiver.PNGFile Tail.PNG

The problem is that Debug logs have not been delievered from indicated path to datasource (receiver). Does anybody encountered and fixed the problem like mine? It seems to me that it's common issue.

4 Replies
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 5

Re: Microsoft Sharepoint Logs

Not to hijack the thread, but you were able to get the collector to run on Windows 2012 Server?  We have been trying to do this for some months without success.

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 5

Re: Microsoft Sharepoint Logs

Please look at Article in another thread.

You could also look up device support using LOGbinder for SharePoint, SQL, and Exchange which is integrated through SIA partnership.

Seems to be an issue with the PDF file as I write this - will report.

Level 7
Report Inappropriate Content
Message 4 of 5

Re: Microsoft Sharepoint Logs


We are able to collect SharePoint logs, however unable to get the user name details from the Sharepoint events. i.e. SharePoint's audit log does not provide the names of users or objects. is there a way to fetch the users details or objects?

Level 8
Report Inappropriate Content
Message 5 of 5

Re: Microsoft Sharepoint Logs

This might be a bit late for the original posters but I have spent so much time looking at these configs, for anyone else looking at the screenshots above. You may want to consider:

Checking "Generate Host IDs:"
(Default) Receiver Port: 8082
Data Retrieval: MEF (when use SIEM Collector 11.0 etc)
Changing 'Data Retrieval' will change "Host Name" to add generated "Host ID:"
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community