Netwrix Auditor System Health event log contains the following Event ID: 1236
“Unable to parse the following event: <event data>. Skip this event”
Review the possible error causes:
- Netwrix Auditor could not parse the Audit Data table’s records from the SharePoint Content database.
- The event data may exceed the maximum supported length for the Audit Data table’s records. For example, the SharePoint groups probably have long names (appr. 200 symbols).
- Netwrix Auditor could not parse changes for a specified site collection since it has “Locked – No Access” status.
Depending on the received error type, follow the corresponding resolution prompts.
For causes 1 and 2 do the following:
- To find out the object name that failed to be parsed, navigate to the Netwrix Auditor System Health log, locate the event id 1236 and review its details.
- If the error persists, send the following files to Netwrix Support:
From the computer where Netwrix Auditor resides:
- All files and folders located in %ProgramData%\Netwrix Auditor\Logs\SharePoint Auditing folder.
- Netwrix Auditor System Health event log *.evtx file. In order to create it, open Event Viewer and navigate to Applications and Services logs > Netwrix Auditor System Health, select Save all events as and select Save as .evtx file.
From the computer that hosts SharePoint Central Administration and where the Netwrix Auditor Agent for SharePoint is installed:
- All files located in C:\inetpub\wwwroot\wss\VirtualDirectories\”SharePoint Central Administration Virtual Directory”\Tracing\Netwrix\ folder.
For cause #3 do the following:
- Navigate to Central Administration > Application Management > Configure quotas and locks and select a site collection. Change its status to “Not Locked”. Alternatively, you can unlock your site using SharePoint Management Shell.
To change site status to “Unlock” using SharePoint Management Shell, do the following:
- Make sure that your account complies with the requirements mentioned in the Microsoft technical article:
- SharePoint server, navigate to Start > Microsoft SharePoint “version” Products > SharePoint “version” Management Shell.
- Execute the following command: Set-SPSite -Identity “SiteCollection” -LockState “State”
“SiteCollection” is the URL of the site collection that you want to track or unlock.
“State” is one of the following values:
- Unlock to unlock the site collection and make it available to users.
- NoAdditions to prevent users from adding new content to the site collection. Updates and deletions are still allowed.
- ReadOnly to prevent users from adding, updating, or deleting content.
- NoAccess to prevent users from accessing the site collection and its content. Users who attempt to access the site receive an error.