eG Monitoring
 

Measures reported by SPOFileActTest

Users perform many operations on the files stored in document libraries. Users can access files, view their contents, modify them, rename them, and even delete them. Likewise, users can view SharePoint pages in a site. To be able to efficiently audit the operations that are performed on files and pages, administrators should track each operation closely, determine whether it is a file operation or page operation, accurately identify what operation it is (file access, page view, file modifications, etc.), and also pinpoint which user performed that operation. This is exactly what the SPOFileActTest test helps administrators do!

This test tracks the file and page operations that users perform on SharePoint Online and reports the total count of operations of each type. The type of operations that is most commonly performed on SharePoint Online is thus revealed to administrators. Additionally, the count of unique users who performed the various file/page operations is reported, with detailed diagnostics pointing administrators to the precise users and the operations they performed. This helps administrators identify users who may have performed an unauthorized operation. The unique clients from which the users initiated the file/page operations, the unique sites where the files are stored, and the unique pages viewed are provided as part of detailed diagnostics, so as to enable administrators audit the operations efficiently.

Outputs of the test : One set of results for the Office 365 tenant being monitored.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Total_operations Indicates the total number of file and page operations that were performed by users of SharePoint Online. Number The value of this measure is the sum of the values of all measures reported under the section File/Page Operations, in the Layers tab page of the eG monitoring console
Unique_operations Indicates the count of unique file/page operations performed on SharePoint Online. Number To know which operations were performed, use the detailed diagnosis of this measure.
Unique_users Indicates the count of unique users who performed file/page operations on SharePoint Online. Number To know which are the users who performed a file/page operation, use the detailed diagnosis of this measure.
Unique_client_IPs Indicates the number of unique clients from which the users initiated the file/page operations. Number Use the detailed diagnosis of this measure to determine the IP addresses of the clients from which users performed a file/page operation.
Unique_sites Indicates the number of unique sites where the files/pages accessed, reside. Number Use the detailed diagnosis of the SharePoint Online sites that were accessed for performing a file/page operation.
Affected_item_types Indicates the number of types (file and/or page) of items that were affected by user operations. Number To know what type of items were affected by the user operations, use the detailed diagnosis of this measure.
Unique_destinations Indicates the destination URLs of the file/page operations . Number To know the unique destination URLs, use the detailed diagnosis of this measure.
Unique_user_agents Indicates the unique user agents of browsers used for performing file/page operations. Number To know the unique user-agent strings of the browsers used in file/page operations, use the detailed diagnosis of thi measure.
File_accesses Indicates the number of file access operations that were performed. Number  
File_check_ins Indicates the number of times files were checked in. Number If you want to make changes to a file on a site and you want to make sure no one else can edit it, check out the file. When you have the file checked out, you can edit it online or offline, and save it multiple times, if necessary.

When you finish editing a file, you need to check the file back into the library, so that other people can see your changes and edit the file, if they have permission.

If you decide not to make or keep any changes in the file, you can simply discard your checkout so you do not affect version history.
File_checkouts Indicates the number of file checkout operations performed. Number
File_checkout_discards Indicates the number of file checkout discards performed. Number  
File_copies Indicates the number of times files were copied. Number  
File_deletes Indicates the number of times file delete operations were performed. Number  
File_deletes_frm_I_stage Indicates the number of file deletes performed from the first-stage recycle bin. Number The Recycle Bin in SharePoint Online in Office 365 for business provides a safety net when an site content and site collections are deleted.

When you delete content from a SharePoint site, it's sent to the site's Recycle Bin or first-stage Recycle Bin, where you can restore the deleted content if needed.

If the file is deleted from the site Recycle Bin (i.e., from the first-stage Recycle Bin), it is sent to the Site Collection or Second-Stage Recycle Bin, where a site collection administrator can restore it or delete it permanently.
File_deletes_frm_II_stag Indicates the number of files deleted from the second-stage recycle bin. Number
File_downloads Indicates the number of times users have downloaded files from SharePoint Online. Number  
File_modifications Indicates the number of times files on SharePoint Online have been modified. Number  
File_moves Indicates the number of times files have been moved. Number Files on SharePoint Online can be moved to a different destination in the current library, to OneDrive, or to another SharePoint site.
File_renames Indicates the number of times files have been renamed. Number  
File_restores Indicates the number of times files have been restored from the Recycle Bin to their original location. Number  
File_uploads Indicates the number of file uploads to SharePoint Online. Number  
Page_views Indicates the number of times SharePoint pages have been accessed. Number