从Office365中的管理活动API获取缺少的审核日志 [英] Get missing auditlog from Management Activity API in Office365

问题描述

我们的应用程序调用现成的Office 365管理API来检索存储在SharePoint Online中的文件上的活动和事件.但是，根据我们的实验，该应用似乎无法检索到足够的日志.

Our application calls out-of-the-box Office 365 Management API to retrieve activities and events on files stored in SharePoint Online. However per our experiment, the application can’t seem to retrieve not enough logs.

示例:我们将1000个文件上传到Sharepoint Online中的文档库.我们收到8份订阅.每次订阅，我们最多只能获取100条日志.调用API的获取日志总数可检索600条日志.还不够！

Example: We upload 1000 files to document library in Sharepoint Online. We receive 8 subscriptiona. Each subscription, we only get maximum 100 logs. Total call API get logs to retrieve 600 logs. Not enough!

这里是我的代码以获取订阅

Here my code to get subscription

List<SubscriptionsContent> GetSubscriptionsContents(AuthenticationResult authenticationResult, ManagementAPI m, DateTime startDate, DateTime endDate, bool proxyRequired = false)
    {
        try
        {
            string jsonSubscription = string.Empty;
            string url = string.Empty;
            string logType = "Audit.SharePoint";

            if (authenticationResult != null)
            {
                url = string.Format(UrlFormat, m.TenantId, string.Format("subscriptions/content?contentType={0}&startTime={1}&endTime={2}", logType, startDate.ToUniversalTime().ToString(DateFormat), endDate.ToUniversalTime().ToString(DateFormat)));
                jsonSubscription = ExecuteRequest(url, HttpMethod.Get, authenticationResult);
                //Log.Info("jsonSubscription:");
                //Log.Info(jsonSubscription);
            }
            var listContent = Common.GetListSubscriptionsContent(jsonSubscription);
            Log.Info("Common.GetListSubscriptionsContent(jsonSubscription); Count: " + (listContent != null ? listContent.Count.ToString() : "IS NULL"));
            return listContent;
        }
        catch (Exception ex)
        {
            Log.Error(ex);
            return new List<SubscriptionsContent>();
        }
    }

这是我的代码来执行请求

Here my code to execute Request

public string ExecuteRequest(string url, HttpMethod method, AuthenticationResult token)
    {
        var responseStr = "";
        try
        {
            HttpClient client = new HttpClient();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
            HttpRequestMessage request = new HttpRequestMessage(method, url);
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);
            HttpResponseMessage response = client.SendAsync(request).Result;
            Log.Info("ExecuteRequest(string url, HttpMethod method, AuthenticationResult token): response.StatusCode: " + response.StatusCode + " ; response.ReasonPhrase: " + response.ReasonPhrase + " ; response.RequestMessage: " + response.RequestMessage);


            if (response.IsSuccessStatusCode)
            {
                responseStr = response.Content.ReadAsStringAsync().Result;
            }
        }
        catch (Exception ex)
        {
            Log.Error(ex);
        }

        return responseStr;
    }

这里是我的代码，用于从每个订阅中获取审核日志

Here my code to get audit log from each subscription

List<AuditLog> listAudit = new List<AuditLog>();
                foreach (var item in listSubscription)
                {
                    var jsonAudit = ExecuteRequest(item.ContentUri.ToString(), HttpMethod.Get, authenticationResult);

                    if (string.IsNullOrEmpty(jsonAudit))
                        continue;
                    var listAuditLog = Common.GetListAuditLog(jsonAudit);
                  }

这是我的代码来解析JsonString

Here my code to parser JsonString

public static List<AuditLog> GetListAuditLog(string jsonString)
    {
        try
        {
            return JsonConvert.DeserializeObject<List<AuditLog>>(jsonString);
        }
        catch (Exception ex)
        {
            Log.Error("public static List<AuditLog> GetListAuditLog(string jsonString)", ex.InnerException);
            return new List<AuditLog>();
        }
    }

推荐答案

我认为您需要使用分页标题.

I think that you need to use the pagination header.

如果数据量太大，则API将返回名为NextPageUrl的标头条目，其中包含用于请求下一页结果的地址.此链接(代表查询)将在24小时内可用.

If the amount of data is too big, the API will return a header entry named NextPageUrl containing an address to be used to request the next page of results. This link (representing the query) will be available for 24 hours.

例如.

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
NextPageUrl:https://manage.office.com/api/v1/{tenant_id}/activity/feed/subscriptions/content?contentType=Audit.SharePoint&startTime=2015-10-01&endTime=2015-10-02&nextPage=2015101900R022885001761

因此，如果响应中包含此标头条目，则只需使用NextPageUrl的值来请求更多数据.

So, if the response contains this header entry, just use the value of NextPageUrl to request more data.

重复该过程，直到该头条目不再存在为止.

Repeat the process until this header entry doesn't exists anymore.

您可以在 Office 365管理API参考

这篇关于从Office365中的管理活动API获取缺少的审核日志的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！