eG Monitoring
 

Measures reported by ODBFolderActTest

Folders provide administrators with an efficient way to group and manage content in a OneDrive document library - for eg., using folders you can group reports by fiscal year or department.

By auditing operations performed on folders, administrators can quickly capture folder operations that are unauthorized/suspect, and even identify the users who may have performed them. Monitoring folder operations is also essential for assessing the workload of OneDrive for Business and the type of operations that are contributing to the load. Using the OneDrive Folder Activities test, administrators can efficiently audit and analyze the workload generated by folder operations.

This test tracks the folder operations that users perform on OneDrive for Business and reports the total count of operations of each type. The load imposed by folder operations and the type of operations contributing to this load can thus be determined. Additionally, the count of unique users who performed the various folder operations is reported, with detailed diagnostics pointing administrators to the precise users and the operations they performed. This helps administrators identify users who may have performed an unauthorized operation. The unique clients from which the users initiated the folder operations and the unique sites where the folders are stored are provided as part of detailed diagnostics, so as to enable administrators audit the operations efficiently.

Outputs of the test: One set of results for the Office 365 tenant being monitored.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Total_operations Indicates the total number of folder operations that were performed by users of OneDrive for Business. Number

The value of this measure is the sum of the values of all measures reported under the section Folder Operations, in the Layers tab page of the eG monitoring console.

The value of this measure is a good indicator of the workload imposed by folder operations on OneDrive for Business.
Unique_operations Indicates the count of unique folder operations performed on OneDrive for Business. Number

To know which operations were performed, use the detailed diagnosis of this measure.
Unique_users Indicates the count of unique users who performed folder operations on OneDrive for Business. Number

To know which are the users who performed folder operations, use the detailed diagnosis of this measure.
Unique_client_IPs Indicates the number of unique clients from which the users initiated the folder operations. Number

Use the detailed diagnosis of this measure to determine the IP addresses of the clients from which users performed a folder operation.
Unique_sites Indicates the number of unique sites where the folders accessed, reside. Number

Use the detailed diagnosis of this mesure to figure out the OneDrive sites that were accessed for performing a folder operation.
Affected_item_types Indicates the number of types of items that were affected by the folder operations. Number

To know what type of items were affected by the folder operations, use the detailed diagnosis of this measure.
Unique_destinations Indicates the destination URLs of the folder operations that were performed. Number

To know the unique destination URLs, use the detailed diagnosis of this measure.
Unique_user_agents Indicates the unique user agents of browsers used for performing folder operations. Number

To know the unique user-agent strings of the browsers used in folder operations, use the detailed diagnosis of this measure.
Folder_copies Indicates the number of times folders were copied. Number

 
Folder_creations Indicates the number of folders created. Number

 
Folder_deletions Indicates the number of times folder delete operations were performed. Number

 
Folder_deletions_I_bin Indicates the number of folder deletions performed from the first-stage recycle bin. Number

The OneDrive Recycle Bin provides a safety net when an site content and site collections are deleted.

When you delete content from a OneDrive, it’s sent to the Recycle Bin or first-stage Recycle Bin, where you can restore the deleted content if needed.

If the file/folder is deleted from the Recycle Bin (i.e., from the first-stage Recycle Bin), it is sent to the Second-Stage Recycle Bin, where an administrator can restore it or delete it permanently.
Folder_deletions_II_bin Indicates the number of folders deleted from the second-stage recycle bin. Number

The OneDrive Recycle Bin provides a safety net when an site content and site collections are deleted.

When you delete content from a OneDrive, it's sent to the Recycle Bin or first-stage Recycle Bin, where you can restore the deleted content if needed.

If the file/folder is deleted from the Recycle Bin (i.e., from the first-stage Recycle Bin), it is sent to the Second-Stage Recycle Bin, where an administrator can restore it or delete it permanently.
Folder_modifications Indicates the number of times folders on OneDrive for Business have been modified. Number

 
Folder_moves Indicates the number of times folders have been moved. Number

Files/folders on OneDrive for Business can be moved to a different destination in the current library, to another OneDrive, or to SharePoint site.
Folder_renames Indicates the number of times folders have been renamed. Number

 
Folder_restores Indicates the number of times folders have been restored from the Recycle Bin to their original location. Number