Netwrix Auditor System Health Log - Event ID 1236 / 1036

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following Event ID:
Netwrix Auditor 9.0 and above: 1236
Netwrix Auditor 8.5 and below: 1036

"Unable to parse the following event: <event data>. Skip this event"

Cause Review the possible error causes:
  1. Netwrix Auditor could not parce the AuditData table's records in the SharePoint Content database.
  2. The event data may exceed the maximum supported lenght for the AuditData table's records. For example, the SharePoint groups probably have long names (appr. 200 symbols).
  3. Netwrix Auditor could not parce changes for a specified site collection since it has "Locked - No Access" status. 
Resolution Depending on the received error type, follow the corresponding  resolution prompts.

For causes 1 and 2 do the following:
  1. To find out the object name that failed to be parced, start Event Viewer, navigate to the Netwrix Auditor System Health Log, locate the event 1036 and review its details.
  2. If the error persists, send the following files to Netwrix Support:
From the computer where Netwrix Auditor resides:
  • All files and folders located in %Netwrix Auditor installation folder%\SharePoint Auditing/Tracing folder.
  • Netwrix Auditor System Health Log *.evtx file. To create it, open Event Viewer and navigate to Applications and Services logs --> Netwrix Auditor System Health, select Save all events as and select Save as .evtx file.
From the computer that hosts SharePoint Central Administration and where the Netwrix Auditor Agent for SharePoint is installed:
  • All files located in C:\inetpub\wwwroot\wss\VirtualDirectories\<SharePoint Central Administration Virtual Directory>\Tracing\Netwrix folder.

For cause 3 do the following:
  1. Navigate to Central Administration --> Application Management --> Configure quotas and locks and select a site collection. Change its status to "Not Locked". Alternatively, you can unlock your site using SharePoint Management Shell
To change site status to "Unlock" using SharePoint Management Shell, do the following:
  1. Make sure that your account complies with the requirements mentioned in the Microsoft technical article.
  2. In your SharePoint server, navigate to Start --> Microsoft SharePoint Products <version> SharePoint Management Shell.
  3. Execute the following command:  Set-SPSite -Identity "<SiteCollection>" -LockState "<State>"
<SiteCollection> is the URL of the site collection that you want to track or unlock.
<State> is one of the following values:
  • Unlock to unlock the site collection and make it available to users.

  • NoAdditions to prevent users from adding new content to the site collection. Updates and deletions are still allowed.

  • ReadOnly to prevent users from adding, updating, or deleting content.

  • NoAccess to prevent users from accessing the site collection and its content. Users who attempt to access the site receive an error.

Was this information helpful?