Netwrix Auditor System Health Log - Event ID 1080 / 1280

This article applies to Netwrix Auditor 7.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1280
Netwrix Auditor 8.5 and below: 1080

"Netwrix Auditor Server failed to save audit data to Audit Archive."
Cause The Netwrix Auditor Archive Service service is stopped.
Resolution To save your changes to Audit Archive, do the following: 
  1. Start the Netwrix Auditor Archive Service. To do it, navigate to Start --> Administrative Tools --> Services, locate the service, right-click it and select Start
  2. Restart data collection. Do the following, depending on your current Netwrix Auditor version:
  • For Netwrix Auditor 9.0 and above: navigate to Monitoring Plans --> your SharePoint monitoring plan --> Edit and select Update.
  • For Netwrix Auditor 8.5 and below: navigate to Managed Objects --> your SharePoint_Managed_Object and click Run.
Now your changes are saved in Audit Archive and in the Netwrix_Auditor_SharePoint audit database (or any custom database you specified while this monitoring plan creation).
Was this information helpful?