Netwrix Auditor System Health Log – Event ID 1292

Copy Article URL Copied

The Netwrix Auditor System Health Log contains Event ID 1292, with the Error severity level and the following event message:

Unable to collect content-related events due to the following error:
“Event queue limit was exceeded for SharePoint farm. Events from %start_time% to %end_time% might be skipped.”

Content-related events from the processed SharePoint Farm are received by Netwrix components (Event Receivers) and put in the FIFO memory queue on the SharePoint Web Front-end server. Event Receivers process the queue, writing event records to the SharePoint database. These records are periodically retrieved, processed and stored by Netwrix Auditor to Long-Term Archive as well as Audit database.

If SharePoint content is modified intensively, the number of related events grows rapidly and may lead to the event queue overflow. As a result, some events that occurred in the specified time interval might be missed.

Predefined event queue limit can be modified using the following PowerShell script:

Add-PSSnapin *sharepoint*
$count = 200000 $solution = Get-SPSolution “b715181d-57dd-4d9f-9969-b79612dcbd54” if ($solution.Properties.ContainsKey(‘EventsThreshold’)) { $solution.Properties.Remove(‘EventsThreshold’) } $solution.Properties.Add(‘EventsThreshold’, $count) $solution.Update()

  1. Specify $count = <number_of_events> as the maximum number of events that will be allowed in the memory queue. Default value is 200 000.
  2. Run this script on the target SharePoint server, using the account included in the Farm Administrators group.
  3. Wait for the modification to take effect.

NOTE: Consider that due to increased queue size, SharePoint’s server memory usage might be also increased.

Go Up