Netwrix Auditor System Health Log contains the following Event ID: 1084
“The Change Summary may include incomplete data as the data collection was still in progress when it was sent. No data loss has occurred, the missing events will be listed in the next Change Summary and added to Audit Database”.
Since the data collection exceeded the predefined timeout period for its completion (1 hour), the summary email was generated while the data collection was still in progress.
No data loss has occurred, the missing events will be listed in the next summary email and added to the Audit Archive and Database.
To generate a new summary email, do the following:
Navigate to Managed Objects –> your_SharePoint_Managed_Object and click Run.
If the error persists:
- Exit Netwrix Auditor.
- Stop the following services:
- Netwrix Auditor Core Service
- Netwrix Auditor Configuration Server Service
- Netwrix Auditor Service for SharePoint (your_SharePoint_Managed_Object_name).
- Navigate to %ProgramData\%Netwrix Auditor\AuditCore\ConfigServer\Configuration.xml. Find your Managed Object name in the configuration file:
<a n=”Name” t=”2″ v=”your_SharePoint_Managed_Object_name”/>
- Locate the <a n=”SynchronizationTaskWaitTimeout” t=”5″ v=”36000000000″/> string and set SynchronizationTaskWaitTimeout to “72000000000”.
- Save the Configuration.xml file and start the services you have stopped on the step 2. To do it, navigate to Start –> Administrative Tools –> Services, locate the service, right-click it and select Start.