Netwrix Auditor System Health Log contains the following Event ID: 1241
“Audit settings for security events in site collection <ID> are not configured properly. As a result, some security events may be lost“.
The Editing users and permissions audit is disabled on the site collection.
Navigate to Monitoring Plans -> Your Monitoring Plan which contains SharePoint Data Source -> Select the Data Source and click Edit Data Source. Then select Adjust audit settings automatically.
On your site collection that must be included in the audited scope, navigate to Site settings –> Site collection audit settings–> Specify the events to audit and select Editing users and permissions.