Netwrix Auditor System Health Log contains the following EventID: 1287
“Audit settings for read access events in site collection <ID> are not configured properly. As a result, some read access events may be lost”.
The Opening or downloading documents, viewing items and lists, or viewing item properties audit is disabled on the site collection.
- On the site collection, where the site included in the read scope resides, navigate to Site Settings –> Site Collection Administration –> Site Collection Audit Settings and select the Opening or downloading documents, viewing items and lists, or viewing item properties under Documents and Items.
- Navigate to Monitoring Plans –> your SharePoint monitoring plan –> Edit data source –> Configure audit settings. Select Adjust audit settings automatically.