Skip to main content

Event ID 1211, 1215, 1226-1235, 1246-1248 in Health Log

Symptoms​

Your SharePoint monitoring plan in Netwrix Auditor prompts one of the following error messages under Event ID 1211, 1215, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234, 1235, 1246, 1247, and 1248 in Health Log:

Event ID 1211: An unexpected error occurred while updating the security cache.
Event ID 1215: Unable to delete temporary files when writing audit data to the SQL database due to the following error.
Event ID 1226: The following error occurred when trying to compare the configuration snapshots.
Event ID 1227: Unable to copy file %fileName% to the Audit Archive.
Event ID 1228: Unable to copy audit data to the Audit Archive.
Event ID 1229: Unable to save the configuration snapshot to the Audit Archive due to the following...
Event ID 1230: Unable to delete temporary file %fileName%.
Event ID 1231: The following unexpected error occurred when trying to delete temporary files from the local repository.
Event ID 1232: The following unexpected error occurred when trying to generate a zip archive with audit data to be copied to the Audit Archive.
Event ID 1233: The following error occurred when trying to delete old audit data from the local repository.
Event ID 1234: Unable to load cache for SharePoint <groups/roles> due to the following error: %errormsg%.
Event ID 1235: Unable to save <groups/roles> cache to the local repository.
Event ID 1246: Unable to delete the following zip archive %fileName% with old audit data from the local repository.
Event ID 1247: The following error occurred when trying to read audit data from the repository: %errormsg%.This data will be skipped.
Event ID 1248: Unable to parse an event due to the following error message: %errormsg%. This event will be skipped.

Causes​

  1. The data located in the target folder is corrupted or used by another process.
  2. An unexpected error occurred.

Resolutions​

Refer to the following resolutions:

  • In case the error message contains a file name, verify the file is accessible and is not used by another process.
  • Recreate your SharePoint monitoring plan in Netwrix Auditor. Refer to the following article for additional information on configuration of SharePoint monitoring plans: Monitoring Plans − SharePoint · v10.6.
  • Monitoring Plans − SharePoint · v10.6