Netwrix Auditor System Health Log – Event ID 1281 – 1283

Copy Article URL Copied

Netwrix Auditor System Health Log contains the following EventID: 1281, 1282, 1283

Event ID 1281: Failed to delete temporary files while saving audit data to Audit Archive due to the following error: <errormsg>.

Event ID 1282: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Audit data retrieving restarted from the beginning, hence, reports and ActivitySummaries may contain duplicate data. 

Event ID 1283: Netwrix Auditor Server failed to read an internal file from Audit Archive: <errormsg>. Some audit data may be missing in your Activity Summaries and reports. 

Review the possible error causes:

  • The Data Processing Account has insufficient rights to access: %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\< GUID> folder, where <GUID*> is the identifier for the monitoring plan.
  • The data located in this folder is corrupted or locked by another process.
  • Unexpected error occured.

​* ​To view your monitoring plan​ GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your monitoring plan name in the configuration file:

-<n n=”ManagedObjects”>
<a n=”Name” t=”2″ v=”your_SharePoint_Monitoring_Plan_name”/>

Follow the resolution prompts:

  1. Grant your Data Processing Account the access permission to %programdata%\Netwrix Auditor\Data\Netwrix Auditor for SharePoint\<GUID> folder.
  2. If the error contains a file name, make sure that it is accessible and not locked.
  3. Try re-creating your monitoring plan.


Go Up