This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event IDs and provides resolution.
||Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1211, 1215, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234, 1235, 1246, 1247, 1248.
Netwrix Auditor 8.5 and below: 1011, 1015, 1026, 1027, 1028, 1029, 1030, 1031, 1032, 1033, 1034, 1035, 1046, 1047, 1048.
|An unexpected error occurred while updating the security cache.||
- The Data Processing Account has insufficient rights to access: %ProgramData%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\Configuration\<Monitoring plan (Managed Object for Netwrix Auditor 8.5 and below) GUID*> \folder.
- The data located in this folder is corrupted or locked by another process.
- Unexpected error occurred.
|1215 / 1015||Unable to delete temporary files when writing audit data to the SQL database due to the following error.|
|1226 / 1026||The following error occurred when trying to compare the configuration snapshots.|
|1227 / 1027||Unable to copy file <fileName> to the Audit Archive.|
|1228 / 1028||Unable to copy audit data to the Audit Archive.|
|1229 / 1029||Unable to save the configuration snapshot to the Audit Archive due to the following...|
|1230 / 1030||Unable to delete temporary file <file name>.|
|1231 / 1031||The following unexpected error occurred when trying to delete temporary files from the local repository.|
|1232 / 1032||The following unexpected error occurred when trying to generate a zip archive with audit data to be copied to the Audit Archive.|
|1233 / 1033||The following error occurred when trying to delete old audit data from the local repository.|
|1234 / 1034||Unable to load cache for SharePoint <groups/roles> due to the following error: <errormsg>. |
|1235 / 1035||Unable to save <groups/roles> cache to the local repository.|
|1246 / 1046||Unable to delete the following zip archive <file name> with old audit data from the local repository.|
|1247 / 1047||
The following error occurred when trying to read audit data from the repository: <errormsg>.
This data will be skipped.
|1248 / 1048||
Unable to parse an event due to the following error message: <errormsg>.
This event will be skipped.
- Grant your Data Processing Account the access permission to <Managed Object name> folder. Depending on your current Netwrix Auditor version, navigate to %ProgramData%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\Configuration\<Monitoring plan (Managed Object for Netwrix Auditor 8.5 and below) GUID*> folder.
- *To view your monitoring plan GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your Managed Object name in the configuration file:
-<n n = "ManagedObjects">
<a n = "Name" t="2" v="your_SharePoint_Managed_Object_name"/>
- If the error contains a file name, make sure that it is accessible and not locked.
- Try re-creating your Monitoring Plan (Managed Object in the versions 7 and 8).