Netwrix Auditor System Health Log - Event ID 1284 / 1084

This article applies to Netwrix Auditor 7.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following Event ID:
Netwrix Auditor 9.0 and above: 1284
"The Activity Summary may include incomplete data as the data collection was still in progress when it was sent. No data loss has occurred, the missing events will be listed in the next Activity Summary and added to AuditArchive".
Netwrix Auditor 8.5 and below: 1084
"The Change Summary may include incomplete data as the data collection was still in progress when it was sent. No data loss has occurred, the missing events will be listed in the next Change Summary and added to Audit Database".
 
Cause Since the data collection exceeded the predefined timeout period for its completion (1 hour), the summary email was generated while the data collection was still in progress.
Resolution No data loss has occurred, the missing events will be listed in the next summary email and added to the Audit Archive and Database.
To generate a new summary email,do the following depending on your Netwrix Auditor version:

Netwrix Auditor 9.5:
Navigate to Monitoring plans --> <your SharePoint monitoring plan name> --> Edit and click Update

Netwrix Auditor 8.5 and below:
Navigate to Managed Objects --> your_SharePoint_Managed_Object and click Run.

If the error persists:
  1. Exit Netwrix Auditor.
  2. Stop the following services:
    • Netwrix Auditor Core Service
    • Netwrix Auditor Configuration Server Service
    • Netwrix Auditor Service for SharePoint (your_SharePoint_Managed_Object_name).
  3. Navigate to %ProgramData%\Netwrix Auditor\AuditCore\ConfigServer\Configuration.xml. Find your monitoring plan (Managed Object in Netwrix Auditor 8.5 and below) name in the configuration file:
-<n n="ManagedObjects">
.....
<a n="Name" t="2" v="your_SharePoint_Managed_Object_name"/>
  1. Locate the <a n="SynchronizationTaskWaitTimeout" t="5" v="36000000000"/> string and set SynchronizationTaskWaitTimeout to "72000000000".
  2. Save the Configuration.xml file and start the services you have stopped on the step 2. To do it, navigate to Start --> Administrative Tools --> Services, locate the service, right-click it and select Start

 
Was this information helpful?