Netwrix Auditor System Health Log - Event ID 1239 / 1039

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1239
Netwrix Auditor 8.5 and below: 1039


"The Audit log trimming setting for some SharePoint sites is not configured correctly. The recommended period is 7 days".
Cause The Audit log trimming for the site collection is turned off or exceeds 7 days.
Resolution Do one of the following, depending on your Netwrix Auditor version:
  • In Netwrix Auditor 9.0 and above, navigate to Monitoring Plans -> Your Monitoring Plan which contains SharePoint Data Source -> Select the Data Source and click Edit Data Source. Then select Adjust audit settings automatically.
  • In Netwrix Auditor 7.0 - 8.5 open Netwrix Auditor Administrator Console, navigate to Managed Objects --> your_SharePoint_Managed_Object  --> SharePoint and click Configure Options. In the Options dialog, select Adjust audit settings automatically.

On your site collection, that must be included in the auditing scope, navigate to Site settings --> Site collection audit settings. In the Audit Log Trimming section, do the following:
  • Set Automatically trim the audit log for this site to "Yes".
  • In Specify the number of days of audit log data to retain set  retention to 7 days.
Was this information helpful?