For your first question, I recall that if you cancel a document import at some stage the server will audit that as a deletion of the document.  Are there "Create Document" events immediately before the unexplained "Delete Entry"s?

Miruna's suggestions for the second question are good; also note that if you have the recycle bin enabled, recycling entries has its own set of events.

Hi Andrew,

Your point is very interesting indeed. We are implementing the solution and the client is mass migrating their documents in phases. There are cases where there are crashes and the import is aborted. Is that recorded as a delete or a failed import? If it is recorded as a delete, then how do we differentiate from a genuine delete case.

Moreover, if the user generates pages and the older pages are overwritten, how is this event considered?

Recycle bin is also enabled for the users.

When I checked on the individual users, they appear to inherit the settings from the everyone group. Are there other places where I can countercheck the effective features & audit?

Thanks

They are just copying from their Windows fileserver to the respective folders in Laserfiche - copy/paste or drag and drop. The imports stop when the Laserfiche client crashes (where most reasons are related to their OS - WinXP, lack of resources on PC) or they may also cancel the import.

The other issue which I just checked was the user whose delete actions were not appearing on the audit report. The user just deleted the item and the item was sent in the recycle bin. Same has still not appeared in the report. The account is a Windows account. I attached the user's effective audit actions in my previous post. Please also advise which parameter to select on the report (I've tried all the delete parameters in Entry & Electronic data) or where can I countercheck for the user's audited action. 

Thanks