Netwrix Auditor System Health Log - Event ID 1005 / 1205

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1205
Netwrix Auditor 8.5 and below: 1005


"The following unexpected error has occurred: <error>".
Cause If this Event ID is logged with the following error in the description: "Could not connect to <URL>/_vti_bin/Netwrix/ManagementService.svc. TCP error code 10060.: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond <address>", this is due to the following reason:
  • There is no network connection between the computer where Netwrix Auditor is installed and the computer that hosts SharePoint Central Administration, or the WebService is not responding.
if this Event ID is logged with the following error in the description: "Insufficient winsock resources available to complete socket connection initiation", this is due to the following reason:
  • There are not enough system resources on the computer where SharePoint Central Administration is installed.
If this Event ID is logged with the following error in the description: "The requested service <service name> could not be activated", this can be due to one of the following reasons:  
  • There are not enough system resources on the computer where SharePoint Central Administration is installed.
  • Access to the Central Administration site is performed through the https protocol, and it is not specified in the Alternate Access Mapping.
  • Access to the Central Administration site is performed through alternative access, and the IIS Bindings contains several Host names for the Central Administration site.
Resolution To resolve the issue do one of the following depending on the reason:
  • Make sure that SharePoint Central Administration is reachable.
  • Free or add system resources and execute the "iisreset" command.
  • Specify the URL in the Alternate Access Mappnig for the Central Administration site, or use a different URL when creating a monitoring plan.
  • Leave one Host Name for the Central Administration site in IIS Bindings.

 
Was this information helpful?