Netwrix Auditor System Health Log contains the following EventID: 1281, 1282, 1283
Event ID 1281: Failed to delete temporary files while saving audit data to Audit Archive due to the following error: <errormsg>.
Event ID 1282: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Audit data retrieving restarted from the beginning, hence, reports and ActivitySummaries may contain duplicate data.
Event ID 1283: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Some audit data may be missing in your Activity Summaries and reports.
Review the possible error causes:
- The Data Processing Account has insufficient rights to access: %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\< GUID> folder, where <GUID*> is the identifier for the monitoring plan.
- The data located in this folder is corrupted or locked by another process.
- Unexpected error occured.
* To view your monitoring plan GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your monitoring plan name in the configuration file:
<a n=”Name” t=”2″ v=”your_SharePoint_Monitoring_Plan_name”/>
Follow the resolution prompts:
- Grant your Data Processing Account the access permission to %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\<GUID> folder.
- If the error contains a file name, make sure that it is accessible and not locked.
- Try re-creating your monitoring plan.