eG Monitoring
 

Measures reported by SPOFolderActTest

Folders provide administrators with an efficient way to group and manage content in a SharePoint Online document library - for eg., using folders you can group reports by fiscal year or department.

By auditing operations performed on folders, administrators can quickly capture folder operations that are unauthorized/suspect, and even identify the users who may have performed them. Monitoring folder operations is also essential for assessing the workload of SharePoint Online and the type of operations that are contributing to the load. Using the SPOFolderActTest test, administrators can efficiently audit and analyze the workload generated by folder operations.

This test tracks the folder operations that users perform on SharePoint Online and reports the total count of operations of each type. The load imposed by folder operations and the type of operations contributing to this load can thus be determined. Additionally, the count of unique users who performed the various folder operations is reported, with detailed diagnostics pointing administrators to the precise users and the operations they performed. This helps administrators identify users who may have performed an unauthorized operation. The unique clients from which the users initiated the folder operations and the unique sites where the folders are stored are provided as part of detailed diagnostics, so as to enable administrators audit the operations efficiently.

Outputs of the test : One set of results for the Office 365 tenant being monitored.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Total_operations Indicates the total number of folder operations that were performed by users of SharePoint Online. Number The value of this measure is the sum of the values of all measures reported under the section Folder Operations, in the Layers tab page of the eG monitoring console.

The value of this measure is a good indicator of the workload imposed by folder operations on SharePoint Online.
Unique_operations Indicates the count of unique folder operations performed on SharePoint Online. Number To know which operations were performed, use the detailed diagnosis of this measure.
Unique_users Indicates the count of unique users who performed folder operations on SharePoint Online. Number To know which are the users who performed folder operations, use the detailed diagnosis of this measure.
Unique_client_IPs Indicates the number of unique clients from which the users initiated the folder operations. Number Use the detailed diagnosis of this measure to determine the IP addresses of the clients from which users performed a folder operation.
Unique_sites Indicates the number of unique sites where the folders accessed, reside. Number Use the detailed diagnosis of the SharePoint Online sites that were accessed for performing a folder operation.
Affected_item_types Indicates the number of types of items that were affected by the folder operations. Number To know what type of items were affected by the folder operations, use the detailed diagnosis of this measure.
Unique_destinations Indicates the destination URLs of the folder operations that were performed. Number To know the unique destination URLs, use the detailed diagnosis of this measure.
Unique_user_agents Indicates the unique user agents of browsers used for performing folder operations. Number To know the unique user-agent strings of the browsers used in folder operations, use the detailed diagnosis of thi measure.
Folder_copies Indicates the number of times folders were copied. Number  
Folder_creations Indicates the number of folders created. Number  
Folder_deletions Indicates the number of times folder delete operations were performed. Number  
Folder_modifications Indicates the number of times folders on SharePoint Online have been modified. Number  
Folder_moves Indicates the number of times folders have been moved. Number Files/folders on SharePoint Online can be moved to a different destination in the current library, to OneDrive, or to another SharePoint site.
Folder_renames Indicates the number of times folders have been renamed. Number  
Folder_restores Indicates the number of times folders have been restored from the Recycle Bin to their original location. Number  
Folder_deletions_I_bin Indicates the number of folder deletions performed from the first-stage recycle bin. Number The Recycle Bin in SharePoint Online in Office 365 for business provides a safety net when an site content and site collections are deleted.

When you delete content from a SharePoint site, it's sent to the site's Recycle Bin or first-stage Recycle Bin, where you can restore the deleted content if needed.

If the file/folder is deleted from the site Recycle Bin (i.e., from the first-stage Recycle Bin), it is sent to the Site Collection or Second-Stage Recycle Bin, where a site collection administrator can restore it or delete it permanently.
Folder_deletions_II_bin Indicates the number of folders deleted from the second-stage recycle bin. Number