Netwrix Auditor System Health Log contains the following Event ID: 1284
“The Activity Summary may include incomplete data as the data collection was still in progress when it was sent. No data loss has occurred, the missing events will be listed in the next Activity Summary and added to AuditArchive“.
Since the data collection exceeded the predefined timeout period for its completion (1 hour), the summary email was generated while the data collection was still in progress.
No data loss has occurred, the missing events will be listed in the next summary email and added to the Audit Archive and Database.
To generate a new summary email, do the following:
Navigate to Monitoring plans –> <your SharePoint monitoring plan name> –> Edit and click Update.
If the error persists:
- Exit Netwrix Auditor.
- Stop the following services:
- Netwrix Auditor Core Service
- Netwrix Auditor Configuration Server Service
- Netwrix Auditor Service for SharePoint (your_SharePoint_Monitoring_Plan_name).
- Navigate to %ProgramData%\Netwrix Auditor\AuditCore\ConfigServer\Configuration.xml. Find your monitoring plan name in the configuration file:
<a n=”Name” t=”2″ v=”your_SharePoint_Monitoring_Plan_name”/>
- Locate the <a n=”SynchronizationTaskWaitTimeout” t=”5″ v=”36000000000″/> string and set SynchronizationTaskWaitTimeout to “72000000000”.
- Save the Configuration.xml file and start the services you have stopped on the step 2. To do it, navigate to Start –> Administrative Tools –> Services, locate the service, right-click it and select Start.