Netwrix Auditor System Health Log - Event ID 1292

This article applies to Netwrix Auditor 9.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Symptoms The Netwrix Auditor System Health Log contains Event ID 1292, with the Error severity level and the following event message:

Unable to collect content-related events due to the following error:
“Event queue limit was exceeded for SharePoint farm. Events from %start_time% to %end_time% might be skipped.”

 
Cause Content-related events from the processed SharePoint Farm are received by Netwrix components (Event Receivers) and put in the FIFO memory queue on the SharePoint Web Front-end server. Event Receivers process the queue, writing event records to the SharePoint database. These records are periodically retrieved, processed and stored by Netwrix Auditor to Netwrix Long-Term Archive and Audit database for searching and reporting.

If SharePoint content is modified intensively, the number of related events grows rapidly and may lead to the event queue overflow. As a result, some events that occurred in the specified time interval might be missed.
 
Resolution Predefined event queue limit can be modified using the following PowerShell script:
Add-PSSnapin *sharepoint*

$count = 200000

$solution = Get-SPSolution "b715181d-57dd-4d9f-9969-b79612dcbd54" 
if ($solution.Properties.ContainsKey('EventsThreshold')) 
{ $solution.Properties.Remove('EventsThreshold') }
$solution.Properties.Add('EventsThreshold', $count)
$solution.Update()
  1. Specify $count = <number_of_events> as the maximum number of events that will be allowed in the memory queue. Default value is 200 000.
  2. Run this script on the target SharePoint server, using the account included in the Farm Administrators group. 
  3. Wait for the modification to take effect.

NOTE: Consider that due to increased queue size, SharePoint server memory usage may also increase. 
 
Was this information helpful?