How to change SPAudit entries?

Question

For example, I want to get all audit entries and increase EventDate on one hour, and after save changes. So generaly I want to be able to change SPAuditEntry properties and after update all changes in DB. Is it possible?

Answer 1

There is no API to modify an existing event entry.

The only way I know is with a SQL script directly modify the records in AuditData table in the content database. I'm not sure will that action leave your DB in 'unsupported mode' or not. You better check that with MSFT first.

Answer 2

you can read the audit log with following code

Private void ReadAuditLog()
        {
            using (SPSite site = new SPSite("your site url"))
            {
                using(SPWeb web=site.OpenWeb())
                {
                    SPList list=web.Lists["your document library name"];
                    SPAuditQuery query = new SPAuditQuery(site);

                    //only query items which have been viewed.
                    query.AddEventRestriction(SPAuditEventType.View);

//set the query date range
                    query.SetRangeEnd(DateTime.Now);
                    query.SetRangeStart(DateTime.Now.AddMonths(-1));

                    //set the scope of query to SPList
                    query.RestrictToList(list);

                    SPAuditEntryCollection auditCol = web.Audit.GetEntries(query);



                    foreach (SPAuditEntry audit in auditCol)

                    {

                    }
                }
            }
        }

for more information on how to access and modify audit using code http://mysharepointwork.blogspot.in/2010/09/programmatically-access-audit-for.html