Netwrix Auditor System Health Log contains the following EventID: 1081, 1082, 1083:
Event ID 1081: Failed to delete temporary files while saving audit data to Audit Archive due to the following error: <errormsg>.
Event ID 1082: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Audit data retrieving restarted from the beginning, hence, reports and ActivitySummaries may contain duplicate data.
Event ID 1083: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Some audit data may be missing in your Activity Summaries and reports.
Review the possible error causes:
- The Data Processing Account has insufficient rights to access: %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\< GUID> folder, where <GUID*> is the identifier for the Managed Object.
- The data located in this folder is corrupted or locked by another process.
- Unexpected error occured.
* To view your Managed Object GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your monitoring plan name in the configuration file:
<a n=”Name” t=”2″ v=”your_SharePoint_Managed_Object_name”/>
Follow the resolution prompts:
- Grant your Data Processing Account the access permission to %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\<GUID> folder.
- If the error contains a file name, make sure that it is accessible and not locked.
- Try re-creating your Managed Object.