What does the field <newauditmask> in the audit logs mean?

Question

I see this in the Eventdata field of audit log reports for the event 'Audit mask change'

<NewAuditMask>15295</NewAuditMask>
<NewAuditMask>0</NewAuditMask>
<NewAuditMask>256</NewAuditMask>

Is there some way to find out what these numbers actually mean? Can the Sharepoint object model be used to find what these numbers mean? MSDN is not very helpful on this topic.

Answer 1

To store settings about actions and events that are audited SharePoint uses SPAuditMaskType enumeration.

public enum SPAuditMaskType
{
   All = -1,
   None = 0,
   CheckOut = 1,
   CheckIn = 2,
   View = 4,
   Delete = 8,
   Update = 16,
   ProfileChange = 32,
   ChildDelete = 64,
   SchemaChange = 128,
   SecurityChange = 256,
   Undelete = 512,
   Workflow = 1024,
   Copy = 2048,
   Move = 4096,
   Search = 8192,
}

So, if you want to know if a new audit mask includes one of the actions, you can use code like this:

string newAuditMask = "15295";
SPAuditMaskType flags = (SPAuditMaskType)Enum.Parse(typeof(SPAuditMaskType), newAuditMask);
if(flags & SPAuditMaskType.Workflow != SPAuditMaskType.None)
{
   //mask contains Workflow action 
}