"

Netwrix Auditor System Health Log – Event IDs 1011, 1015, 1026-1035, 1046-1048

Last review: May 05, 2015
https://kb.netwrix.com/1118
Copy Article URL Copied

Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID: 1011, 1015, 1026, 1027, 1028, 1029, 1030, 1031, 1032, 1033, 1034, 1035, 1046, 1047, 1048.


1011 An unexpected error occurred while updating the security cache.
  • The Data Processing Account has insufficient rights to access: %ProgramData%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\Configuration\<Managed Object GUID> folder.
  • The data located in this folder is corrupted or locked by another process.
  • Unexpected error occurred.
1015 Unable to delete temporary files when writing audit data to the SQL database due to the following error.
1026 The following error occurred when trying to compare the configuration snapshots.
1027 Unable to copy file <fileName> to the Audit Archive.
1028 Unable to copy audit data to the Audit Archive.
1029 Unable to save the configuration snapshot to the Audit Archive due to the following…
1030 Unable to delete temporary file <file name>.
1031 The following unexpected error occurred when trying to delete temporary files from the local repository.
1032 The following unexpected error occurred when trying to generate a zip archive with audit data to be copied to the Audit Archive.
1033 The following error occurred when trying to delete old audit data from the local repository.
1034 Unable to load cache for SharePoint <groups/roles> due to the following error: <errormsg>.
1035 Unable to save <groups/roles> cache to the local repository.
1046 Unable to delete the following zip archive <file name> with old audit data from the local repository.
1047 The following error occurred when trying to read audit data from the repository: <errormsg>.This data will be skipped.
1048 Unable to parse an event due to the following error message: <errormsg>.This event will be skipped.

  • Grant your Data Processing Account the access permission to <Managed Object name> folder. Depending on your current Netwrix Auditor version, navigate to %ProgramData%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\Configuration\<Managed Object GUID*> folder.
    • *To view your managed object GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\ConfigServer\Configuration.xml. Find your Managed Object name in the configuration file:
-<n n = “ManagedObjects”>

<a n = “Name” t=”2″ v=”your_SharePoint_Managed_Object_name”/>
  • If the error contains a file name, make sure that it is accessible and not locked.
  • Try re-creating your Managed Object
Go Up