Netwrix Auditor System Health Log contains the following EventID: 1087
“Audit settings for read access events in site collection <ID> are not configured properly. As a result, some read access events may be lost”.
The Opening or downloading documents, viewing items and lists, or viewing item properties audit is disabled on the site collection.
- On the site collection, where the site included in the read scope resides, navigate to Site Settings –> Site Collection Administration –> Site Collection Audit Settings and select the Opening or downloading documents, viewing items and lists, or viewing item properties under Documents and Items.
- In the Netwrix Auditor Administrator Console, navigate to Managed Objects –> your_SharePoint_Managed_Object –> SharePoint and click Configure Options. In the Options dialog, select Adjust audit settings automatically.