Netwrix Auditor System Health Log - Event IDs 1211, 1215, 1226-1235, 1246-1248 OR 1011, 1015, 1026-1035, 1046-1048

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event IDs and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1211, 1215, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234, 1235, 1246, 1247, 1248.​
Netwrix Auditor 8.5 and below: 1011, 1015, 1026, 1027, 1028, 1029, 1030, 1031, 1032, 1033, 1034, 1035, 1046, 1047, 1048.


 
Cause
1211
/ 1011
An unexpected error occurred while updating the security cache.
  • The Data Processing Account has insufficient rights to access: %ProgramData%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\Configuration\<Monitoring plan (Managed Object for Netwrix Auditor 8.5 and below) GUID*> \folder.  
  • The data located in this folder is corrupted or locked by another process.
  • Unexpected error occurred.
1215 / 1015Unable to delete temporary files when writing audit data to the SQL database due to the following error.
1226 / 1026The following error occurred when trying to compare the configuration snapshots.
1227 / 1027Unable to copy file <fileName> to the Audit Archive.
1228 / 1028Unable to copy audit data to the Audit Archive.
1229 / 1029Unable to save the configuration snapshot to the Audit Archive due to the following...
1230 / 1030Unable to delete temporary file <file name>.
1231 / 1031The following unexpected error occurred when trying to delete temporary files from the local repository.
1232 / 1032The following unexpected error occurred when trying to generate a zip archive with audit data to be copied to the Audit Archive.
1233 / 1033The following error occurred when trying to delete old audit data from the local repository.
1234 / 1034Unable to load cache for SharePoint <groups/roles> due to the following error: <errormsg>. 
1235 / 1035Unable to save <groups/roles> cache to the local repository.
1246 / 1046Unable to delete the following zip archive <file name> with old audit data from the local repository.
1247 / 1047
The following error occurred when trying to read audit data from the repository: <errormsg>.
 
This data will be skipped. 
1248 / 1048
Unable to parse an event due to the following error message: <errormsg>.
This event will be skipped.
Resolution
  • Grant your Data Processing Account the access permission to <Managed Object name> folder. Depending on your current Netwrix Auditor version, navigate to %ProgramData%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\Configuration\<Monitoring plan (Managed Object for Netwrix Auditor 8.5 and below) GUID*> folder.
    • *To view your monitoring plan GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your Managed Object name in the configuration file:
-<n n = "ManagedObjects">
...
<a n = "Name" t="2" v="your_SharePoint_Managed_Object_name"/>
  • If the error contains a file name, make sure that it is accessible and not locked.
  • Try re-creating your Monitoring Plan (Managed Object in the versions 7 and 8).
Was this information helpful?