Netwrix Auditor System Health Log - Event ID 1087 / 1287

This article applies to Netwrix Auditor 8.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1287
Netwrix Auditor 8.5 and below: 1087

"Audit settings for read access events in site collection <ID> are not configured properly. As a result, some read access events may be lost". 
Cause The Opening or downloading documents, viewing items and lists, or viewing item properties audit is disabled on the site collection.
Resolution
  1. On the site collection, where the site included in the read scope resides, navigate to Site Settings --> Site Collection Administration --> Site Collection Audit Settings and select the Opening or downloading documents, viewing items and lists, or viewing item properties under Documents and Items.
  2. Do the following, depending on your Netwrix Auditor version:
​Netwrix Auditor 9.0 and above: navigate to Monitoring Plans --> your SharePoint monitoring plan --> Edit data source --> Configure audit settings. Select Adjust audit settings automatically.
Netwrix Auditor 8.0 and 8.5: In the Netwrix Auditor Administrator Console, navigate to Managed Objects --> your_SharePoint_Managed_Object  --> SharePoint and click Configure Options. In the Options dialog, select Adjust audit settings automatically.
Was this information helpful?