📄️ Known Issue - Mailbox Audit Data Collection
This article addresses a known issue in Netwrix Auditor version 10.6 related to the inability to collect mailbox audit data due to an unhandled value.
📄️ Auditor v10.6 Known Issue
This article addresses the known issue in Auditor v10.6 where the subscription plan for Access Reviews has expired, resulting in an error message.
📄️ Empty Event ID 5356 − CSV File Missing in Event Log Export Add-on
Explains why empty Event ID 5356/5536 appears and why the CSV file referenced in the Test Run message is missing; clarifies storage and deletion behavior for the Event Log Export Add-on in Netwrix Auditor.
📄️ Entitlement Reviews — Event ID 6527
Netwrix Auditor logs show Event ID 6527 indicating the Entitlement Reviews license has expired while Access Reviews collectors remain active. This article explains the cause and steps to stop the errors using the Access Reviews Configuration Tool.
📄️ Error: Event ID 1206 in Health Log
Describes the cause and resolution for Event ID 1206 logged in the Netwrix Auditor System Health Log when the SharePoint Core Service cannot be found.
📄️ Event ID 1000 Application Errors in Netwrix Audito
Describes causes and resolutions for Event ID 1000 application errors on the Netwrix Auditor server, including steps to repair corrupted DLLs and run system scans.
📄️ Event ID 1024 in Health Log
Explains how to resolve Event ID 1024 "Email delivery failed." in the Netwrix Auditor Health Log for SharePoint monitoring plans by regenerating the Activity Summary and collecting logs for support.
📄️ Event ID 1079 in Health Log
Explains Event ID 1079 in the Health Log when a SharePoint monitoring plan generates an incomplete Change Summary due to a data collection timeout, and provides steps to generate a new Activity Summary.
📄️ Event ID 1203 in Health Log
Explains Event ID 1203 that appears in the Health Log when a SharePoint monitoring plan fails to start due to missing or inaccessible configuration files. Provides steps to resolve the issue by recreating the monitoring plan and links to configuration guidance.
📄️ Event ID 1204 in Health Log
This article describes causes and resolutions for Event ID 1204 ("Unable to establish connection to the remote WebService") that appears in the Health Log for a SharePoint monitoring plan in Netwrix Auditor.
📄️ Event ID 1205 in Health Log
Explains Event ID 1205 that appears in the Health Log for SharePoint monitoring in Netwrix Auditor, lists possible causes, and provides resolutions to troubleshoot the issue.
📄️ Event ID 1207 in Health Log
Explains how to resolve Event ID 1207 in the Health Log when SharePoint monitoring reports an automatic SharePoint Core Service deployment failure. Describes the cause and the manual uninstall/reinstall steps for the Netwrix Auditor for SharePoint Core Service.
📄️ Event ID 1208 in Health Log
Describes causes and resolutions for Event ID 1208 in the Health Log when automatic SharePoint Core Service deployment fails in Netwrix Auditor.
📄️ Event ID 1209 in Health Log
Event ID 1209 occurs when Netwrix Auditor cannot obtain SharePoint groups for a site collection due to permission or lock status issues. This article explains causes and resolutions.
📄️ Event ID 1210 in Health Log
Explains Event ID 1210 entries in the Health Log for SharePoint monitoring plans and provides causes and resolutions for the two common error messages.
📄️ Event ID 1211, 1215, 1226-1235, 1246-1248 in Healt
Lists Health Log events 1211, 1215, 1226–1235, 1246–1248 related to SharePoint monitoring, explains causes, and provides resolutions including recreating the monitoring plan in Netwrix Auditor.
📄️ Event ID 1212 in Health Log
This article explains Event ID 1212 health log errors that occur when Netwrix Auditor collects SharePoint content events and provides causes and resolutions for three common error messages.
📄️ Event ID 1214 in Health Log
Explains Event ID 1214 in the Health Log for SharePoint monitoring plans, lists possible causes, and provides step-by-step resolutions to restore audit data writes to the SQL database.
📄️ Event ID 1216, 1217, 1218, 1219 in Health Log
Netwrix Auditor reports Event ID 1216, 1217, 1218, or 1219 in the Health Log when it cannot collect AD group membership information for SharePoint monitoring. This article lists the error messages, causes, and resolutions, including file paths for the membership database and configuration.
📄️ Event ID 1223 in Health Log
This article explains Event ID 1223 in the Health Log for SharePoint monitoring plans and provides causes and step-by-step resolutions for the "Email delivery to recipient %recepient% failed." error.
📄️ Event ID 1225 in Health Log
You see Event ID 1225 in the Health Log when Netwrix Auditor cannot make a configuration snapshot of the audited SharePoint farm. This article lists possible causes and links to related Health Log event articles to help you troubleshoot.
📄️ Event ID 1236 in Health Log
Explains Event ID 1236 in the Health Log where Netwrix Auditor cannot parse a SharePoint event due to a site collection locked as "Locked — No Access", and shows how to resolve it by unlocking the site collection.
📄️ Event ID 1239 in Health Log
This article explains Event ID 1239 in the Health Log for a SharePoint monitoring plan, including the cause and steps to configure audit log trimming to the recommended 7 days.
📄️ Event ID 1240 in Health Log
Explains causes and resolutions for Event ID 1240 in the Health Log for a SharePoint monitoring plan, including permission and site collection lock status steps and a PowerShell reference.
📄️ Event ID 1241 in Health Log
Describes Event ID 1241 in the Health Log for a SharePoint monitoring plan and explains how to enable the Editing users and permissions audit to prevent lost read access events.
📄️ Event ID 1242 in Health Log
Netwrix Auditor logs Event ID 1242 when it cannot audit a SharePoint site collection due to site collection locks or insufficient permissions. This article lists the event messages, explains causes, and provides step-by-step resolutions.
📄️ Event ID 1243 in Health Log
Describes Event ID 1243 in the Health Log for SharePoint monitoring plans, including possible error messages, causes, and step-by-step resolutions.
📄️ Event ID 1244 in Health Log
This article describes Event ID 1244 errors in the Health Log when Netwrix Auditor cannot remove a SharePoint site collection from the auditing scope, with causes and resolutions for each error variant.
📄️ Event ID 1245 in Health Log
This article explains causes and resolutions for Event ID 1245 in the Health Log, which reports "Unable to remove the Netwrix Auditor configuration from site collection with %site_collection%". It helps you identify the specific error variant and resolve SharePoint site collection lock and permission issues.
📄️ Event ID 1249 in Health Log
Explains Event ID 1249 in the Health Log for Netwrix Auditor SharePoint monitoring plans and provides causes and step-by-step resolutions when audit data cannot be written to the SQL database.
📄️ Event ID 1250 in Health Log
Health Log shows Event ID 1250 when a SharePoint web application URL in a monitoring plan is invalid. This article explains the cause and steps to correct the URL in the monitoring plan.
📄️ Event ID 1251 - 1254, 1256 - 1258 in Health Log
Lists Event IDs 1251–1254 and 1256–1258 that may appear in the Health Log for a SharePoint monitoring plan and provides causes and resolutions.
📄️ Event ID 1255 in Health Log
Explains Event ID 1255 ("Site collection %URL% cannot be found.") in the Health Log for a SharePoint monitoring plan and provides causes and steps to resolve it.
📄️ Event ID 1259 in Health Log
Explains Event ID 1259 in the Health Log for a SharePoint monitoring plan, its cause, and how to restart data collection to resolve the issue.
📄️ Event ID 1260 − 1266 in Health Log
Netwrix Auditor SharePoint monitoring may log Event ID 1260–1266 when configuration snapshots fail; this article describes possible causes and resolutions to restore correct reporting of farm, web application, site collection, feature, solution, permission policy, and server configuration snapshots.
📄️ Event ID 1267 − 1273 in Health Log
Explains Event ID 1267–1273 messages that appear in the Health Log for SharePoint monitoring plans, lists possible causes, and provides resolutions.
📄️ Event ID 1274 in Health Log
Describes causes and resolutions for Event ID 1274 in the Health Log when Netwrix Auditor cannot detect the forest hosting a monitored SharePoint farm, including related events and troubleshooting steps.
📄️ Event ID 1275 in Health Log
Event ID 1275 indicates that the SharePoint Core Service for Netwrix Auditor has been removed from the SharePoint Central Administration server. This article explains the cause and how to let Netwrix Auditor redeploy the service automatically or how to install it manually.
📄️ Event ID 1276 in Health Log
Health Log for a SharePoint monitoring plan can show error messages under Event ID 1259 related to SharePoint audit configuration, SQL Server access, and operation timeouts. This article lists the possible causes and resolutions for those errors.
📄️ Event ID 1280 in Health Log
Health Log shows Event ID 1280 when the Netwrix Auditor Archive Service has stopped; start the service and restart the SharePoint monitoring plan data collection.
📄️ Event ID 1281, 1282, 1283 in Health Log
Describes the causes and resolutions for Event ID 1281, 1282, and 1283 entries in the Health Log related to SharePoint monitoring plans, including the exact error messages and recommended actions.
📄️ Event ID 1285 in Health Log
Describes the cause and resolution for Event ID 1285 ("Web site %URL% cannot be found") in the Health Log for a SharePoint monitoring plan.
📄️ Event ID 1286 in Health Log
Explains causes and resolutions for "Unable to find site %URL%" errors reported in the Health Log for SharePoint monitoring plans.
📄️ Event ID 1287 in Health Log
Describes Event ID 1287 in the Health Log that indicates read-access audit settings are not configured for a SharePoint site collection, and provides steps to enable the required audit settings and update the monitoring plan.
📄️ Event ID 1288 in Health Log
Explains Event ID 1288 Health Log messages for SharePoint monitoring plans and provides causes and step-by-step resolutions for the "Unable to collect read access events" errors.
📄️ Event ID 1289 in Health Log
Describes Event ID 1289 entries in the Health Log for SharePoint monitoring and provides causes and resolutions for two specific error messages related to configuration database access and timeouts.
📄️ Event ID 2002: The Term 'get-help' Is Not Recogniz
Describes Event ID 2002 'get-help' not recognized error in the Netwrix Auditor System Health log and explains that the issue is caused by a Microsoft Exchange cumulative update. Instructs you to upgrade to Netwrix Auditor 10.6 build 12322 or later and includes related links.
📄️ Event ID 5801 in Health Log
Explains Event ID 5801 in the Health Log, which indicates an activity session expired while credentials were in use, and provides possible causes and resolutions when a resource-based policy and Netwrix Privilege Secure are used.
📄️ Event ID 5802 in Health Log
Describes Event ID 5802 in the Health Log where an activity session expires while credentials are in use and explains how to resolve it by increasing the session timeout.
📄️ Event ID 5803 in Health Log
Explains Event ID 5803 in the Health Log of Netwrix Auditor and how to resolve it when an activity session ends while the corresponding credentials were in use.
📄️ Event ID 1237/1238 in Health Log
This article addresses Event ID 1237 and 1238 errors in the Health Log for SharePoint monitoring plans, detailing symptoms, causes, and resolutions.
📄️ Monitored Event IDs
Lists the Windows event IDs that Netwrix Account Lockout Examiner monitors for invalid logons and account lockout/unlock events.
📄️ Netwrix Auditor Health Log Contains Event ID 1119
Netwrix Auditor cannot collect data from a SharePoint farm and the Netwrix Auditor Health Log shows Event ID 1119 with the message "An item with the same key has already been added." This article explains the cause and steps to resolve the issue.
📄️ Netwrix Auditor System Health - Event ID 2007
Explains Event ID 2007 reported by Netwrix Auditor System Health and directs you to SQL Server repair steps to resolve the error.
📄️ Netwrix Auditor System Health Log Contains Event I
After restarting the Netwrix Auditor for Windows Server Compression Service, the monitored item may show Ready but still require action; the System Health log can contain Event IDs 1015 and 1016 indicating registry audit permission issues and registry data provider errors. This article explains the cause and how to grant the necessary registry permissions.
📄️ Netwrix Auditor System Health Log - Event ID 1059
Explains Event ID 1059 in the Netwrix Auditor System Health Log and shows how to resolve failed data collection when you manually start collection during the initial monitoring plan run.
📄️ Netwrix Auditor System Health Log - Event ID 1213
Explains Event ID 1213 in the Netwrix Auditor System Health log, lists three specific error message types, their likely causes, and recommended resolutions.