Event Details
User Activity->Object Access->SharePoint Object Access->ChangeAuditor for SharePoint->List Items access->EventID 257 - List item attachment deleted
EventID 257 - List item attachment deleted
 Sample:

                                
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ChangeAuditor for SharePoint
Filtering Field Equals to Value
EventId 257
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User logon name YDOM\ii
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "List item attachment deleted" List item attachment deleted
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Computer DC1
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain -
WhereDomain -
Result Successful or Failed -
Object Name Item name Web Applications using Claims authentication require an update.
Object Type "List item" List item
Whom -
User logon name User logon name InsertionString46 YDOM\ii
Site URL Site URL InsertionString49 http://yj:26939
List URL List URL InsertionString30 /Lists/CustomList
Attachment file name Attachment file name Attachment file name Word.rtf
Comments
You must be logged in to comment