For those who had the crazy idea to extract audits information from SharePoint 2007, you might have face the same problem I had. I’ll just redefine the context before getting to the solution.
SharePoint and its audit
When a item is deleted in SharePoint, an SPAuditEntry of type Delete is logged into the audit and respects the following format:
Note that beside the Delete type, the EventData object can have a lot of others information related to others types of events.
SharePoint and its audit… and its issues
I was working on a small console application to extract data from the SharePoint audit when I found two issues.
1. EventData is a XML string which is made of multiple root elements
2. Despite what msdn says, the real format for a Delete type of audit looks more like the following:
So if like me, you thought that it would be a good idea to build a XDocument from it on which you could get crazy with LinQ…
then you are wrooooonnnng (cfr 1. et 2.)
Sharepoint and its audit… and its issues… and a solution
So here is a small workaround:
When you are looping through your SPAuditEntryCollection, integrate this piece of great and advanced technology.
It will just check the presence of Recycle, and in this case, insert a root element dummy
and add / before the last occurrence of Recycle to end correctly the tag.
You can now use XDocument.Parse(entryEventData)
Joie! (spécial dédicace à un ancien collègue)
Note that the malformed Recycle element was fixed in SharePoint 2010 but you will still have the issue of the multiple root elements.