eG Monitoring
 

Measures reported by ODBFileActTest

Users perform many operations on the files stored in document libraries. Users can access files, view their contents, modify them, rename them, and even delete them. Likewise, users can view pages in the OneDrive. To be able to efficiently audit the operations that are performed on files and pages, administrators should track each operation closely, determine whether it is a file operation or page operation, accurately identify what operation it is (file access, page view, file modifications, etc.), and also pinpoint which user performed that operation. This is exactly what the OneDrive File and ODBFileActTest helps administrators do!

This test tracks the file and page operations that users perform on OneDrive for Business and reports the total count of operations of each type. The type of operations that is most commonly performed on OneDrive for Business is thus revealed to administrators. Additionally, the count of unique users who performed the various file/page operations is reported, with detailed diagnostics pointing administrators to the precise users and the operations they performed. This helps administrators identify users who may have performed an unauthorized operation. The unique clients from which the users initiated the file/page operations, the unique sites where the files are stored, and the unique pages viewed are provided as part of detailed diagnostics, so as to enable administrators audit the operations efficiently.

Outputs of the test: One set of results for the Office 365 tenant being monitored.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Total_operations Indicates the total number of file and page operations that were performed by users of OneDrive for Business. Number

The value of this measure is the sum of the values of all measures reported under the section File/Page Operations, in the Layers tab page of the eG monitoring console.
Unique_operations Indicates the count of unique file/page operations performed on OneDrive for Business. Number

To know which operations were performed, use the detailed diagnosis of this measure.
Unique_users Indicates the count of unique users who performed file/page operations on OneDrive for Business. Number

To know which are the users who performed a file/page operation, use the detailed diagnosis of this measure.
Unique_client_IPs Indicates the number of unique clients from which the users initiated the file/page operations. Number

Use the detailed diagnosis of this measure to determine the IP addresses of the clients from which users performed a file/page operation.
Unique_sites Indicates the number of unique sites where the files/pages accessed, reside. Number

Use the detailed diagnosis of the OneDrive sites that were accessed for performing a file/page operation.
Affected_item_types Indicates the number of types (file and/or page) of items that were affected by user operations. Number

To know what type of items were affected by the user operations, use the detailed diagnosis of this measure.
Unique_destinations Indicates the destination URLs of the file/page operations. Number

To know the unique destination URLs, use the detailed diagnosis of this measure.
Unique_user_agents Indicates the unique user agents of browsers used for performing file/page operations. Number

To know the unique user-agent strings of the browsers used in file/page operations, use the detailed diagnosis of this measure.
File_accesses Indicates the number of file access operations that were performed. Number

If you want to make changes to a file on a site and you want to make sure no one else can edit it, check out the file. When you have the file checked out, you can edit it online or offline, and save it multiple times, if necessary.
File_check_ins Indicates the number of times files were checked in. Number

When you finish editing a file, you need to check the file back into the library, so that other people can see your changes and edit the file, if they have permission.
File_checkouts Indicates the number of file checkout operations performed. Number

If you decide not to make or keep any changes in the file, you can simply discard your checkout so you do not affect version history.
File_checkout_discards Indicates the number of file checkout discards performed. Number

 
File_copies Indicates the number of times files were copied. Number

 
File_deletes Indicates the number of times file delete operations were performed. Number

 
File_deletes_frm_I_stage Indicates the number of file deletes performed from the first-stage recycle bin. Number

The Recycle Bin in OneDrive for Business in Office 365 for business provides a safety net when an site content and site collections are deleted.

When you delete content from a OneDrive site, it's sent to the site's Recycle Bin or first-stage Recycle Bin, where you can restore the deleted content if needed.

If the file is deleted from the site Recycle Bin (i.e., from the first-stage Recycle Bin), it is sent to the Site Collection or Second-Stage Recycle Bin, where a site collection administrator can restore it or delete it permanently.
File_deletes_frm_II_stag Indicates the number of files deleted from the second-stage recycle bin. Number

The Recycle Bin in OneDrive for Business in Office 365 for business provides a safety net when an site content and site collections are deleted.

When you delete content from a OneDrive site, it's sent to the site's Recycle Bin or first-stage Recycle Bin, where you can restore the deleted content if needed.

If the file is deleted from the site Recycle Bin (i.e., from the first-stage Recycle Bin), it is sent to the Site Collection or Second-Stage Recycle Bin, where a site collection administrator can restore it or delete it permanently.
File_downloads Indicates the number of times users have downloaded files from OneDrive for Business. Number

 
File_modifications Indicates the number of times files on OneDrive for Business have been modified. Number

 
File_moves Indicates the number of times files have been moved. Number

Files on OneDrive for Business can be moved to a different destination in the current library, to OneDrive, or to another SharePoint site.
File_renames Indicates the number of times files have been renamed. Number

 
File_restores Indicates the number of times files have been restored from the Recycle Bin to their original location. Number

 
File_uploads Indicates the number of file uploads to SharePoint Online. Number

 
Page_views Indicates the number of times pages have been accessed from OneDrive. Number