Netwrix Auditor System Health Log - Event ID 1281 - 1283 OR 1081 - 1083

This article applies to Netwrix Auditor 7.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1281, 1282, 1283
Netwrix Auditor 8.5 and below: 1081, 1082, 1083:


Event ID 1281 / 1081: Failed to delete temporary files while saving audit data to Audit Archive due to the following error: <errormsg>.

Event ID 1282 / 1082: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Audit data retrieving restarted from the beginning, hence, reports and ActivitySummaries may contain duplicate data. 

Event ID 1283 / 1083: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Some audit data may be missing in your Activity Summaries and reports. 
Cause Review the possible error causes:
  • The Data Processing Account has insufficient rights to access: %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\< GUID>\ folder, where <GUID*> is the identifier for the monitoring plan (Managed Object in Netwrix Auditor 8.5 and below). 
  • The data located in this folder is corrupted or locked by another process.
  • Unexpected error occured.
​* ​To view your monitoring plan (Managed Object in Netwrix Auditor 8.5 and below)​ GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your monitoring plan name in the configuration file:

-<n n="ManagedObjects">
....
<a n="Name" t="2" v="your_SharePoint_Managed_Object_name"/>
Resolution Follow the resolution prompts:
  1. Grant your Data Processing Account the access permission to %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\<GUID> folder.
  2. If the error contains a file name, make sure that it is accessible and not locked.
  3. Try re-creating your monitoring plan (Managed Object in Netwrix Auditor 8.5 and below).

 
Was this information helpful?