Netwrix Auditor EventLog - Event ID 1049 / 1249

This article applies to Netwrix Auditor 6.5 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1249
Netwrix Auditor 8.5 and below: 1049

"The following error occurred when trying to write audit data to the SQL database".
  • The database is unreachable.
  • Your Data Collecting Account has insufficient permissions to write data to the database.
  • Try connecting to your SQL Server instance, where the database with audit data is stored. Make sure the database is accessible.
    • Navigate to Start --> Run and type "cmd".  Type "ping" and the name of the server where your audit data is stored. Make sure the server is reachable.
    • On your server, where SQL Server instance is hosted, start SQL Server Management Studio, connect to your instance and make sure the database with your audit data exists and not offline.
NOTE: To find out the database name where the audit data for your monitoring plan is stored, navigate to one of the following locations depending on your Netwrix Auditor version:

For Netwrix Auditor 9.0 and above, navigate to Monitoring plans --> Your SharePoint monitoring plan --> Edit settings --> Audit Database.
NOTE: you must be a Global Administrator to view and edit your monitoring plan configuration.
For Netwrix Auditor 8.5 and below, navigate to Managed Objects --> your_Managed_Object_name --> SharePoint --> Audit Database Settings.
Was this information helpful?