How to get the correct audit occurred time from SPAuditEntry

Introduction

I was assigned to a project where I had to retrieve audit data programmatically using C#. I used SPAuditQuery and SPAuditEntry in order to achieve this.

Problem Background

When I retrieve the audit occurred time by spAuditEntry.Occurred; it gives a different value from the actual time.

Solution Background

SharePoint save the audit data in content database in table dbo.AuditData. To see auditing data; open your content database and go to the table dbo.AuditData and see the column “Occurred” there you can see the UTC Date time of the actual audit time. 

I learnt from various blog posts that SharePoint usually store datetime in UTC DateTime format in the content database; and when it want to display the date time in SharePoint site the value stored in database is converted to webapplication’s time and then displays the time according to the time zone the person is in.

Solution

To get the web application time you have to call RegionalSettings.TimeZone.UTCToLocalTime() method.

   
spWeb.RegionalSettings.TimeZone.UTCToLocalTime(spAuditEntry.Occurred)
//spAuditEntry.Occurred is the time stored in content database which is a in DateTime format

Conclusion

So when you retrieve any data from content database programatically  which contains datetime;  please use the above method as you need. I have already blogged on a same kind of issue here. This was to retrieve the LastItemModifiedDate as Local Time.