Netwrix Auditor System Health Log - Event ID 1213 /1013

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1213
Netwrix Auditor 8.5 and below: 1013

The Event ID may contain 3 error types:

Error type 1:
An unexpected error occurred while trying to collect security events from the audited SharePoint farm: Details: Could not find the file: %programdata%\Netwrix Auditor\Netwrix Auditor for SharePoint\Configuration\<Managed Object GUID*>\<any file>.

Error type 2:
An unexpected error occurred while trying to collect security events from the audited SharePoint farm: Details: The content type text/html; charset=utf-8 of the response message does not match the content type of the binding (text/xml; charset=utf-8). If using a custom encoder, be sure that the IsContentTypeSupported method is implemented properly. The first 45 bytes of the response were: 'Cannot connect to the configuration database.'..

Error type 3:
An unexpected error occurred while trying to collect security events from the audited SharePoint farm: The request change timed out while waiting for a reply after 01:00:00. Increase the timeout value passed to the call to Request or increase the SendTimeout value on the Binding. The time allotted to this operation may have been a portion of a longer timeout.
Cause Review the possible error causes:

Error type 1:
The product failed to collect audit data due to a an unexpected error on the Netwrix Auditor side. There is no access to the configuration files, or the file is corrupt.

Error type 2:
The product failed to collect audit data due to an unexpected error on the SharePoint side. The site collection configuration is corrupt, or there is no access to the SharePoint configuration database.

Error type 3:
The product failed to collect audit data as the timeout expired on the SharePoint side. This can be due to maintenance activity in your network, which results in the failure to process requests on the SharePoint side.
Resolution Depending on the received error type, follow the corresponding  resolution prompts:

Error type 1:
Try re-creating the monitoring plan (Managed Object in Netwrix Auditor 8.5 and below)

Error type 2:
Make sure that the audited site collection is reachable. 

Error type 3:
Make sure that the audited SharePoint sites are operational. If this error is logged once, this does not lead to data loss, and all events were collected within 30 minutes after the error occurred. Is this error is logged several times, contact your SharePoint administrator.

*To view your monitoring plan (Managed Object in Netwrix Auditor 8.5 and below) GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your monitoring plan name in the configuration file:

-<n n="ManagedObjects">
....
<a n="Name" t="2" v="your_SharePoint_Managed_Object_name"/>
Was this information helpful?