Lots of logs for event ID 521 Expand / Collapse
Author
Message
Posted 7/6/2017 10:44:13 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 4/22/2017 9:11:25 AM
Posts: 3, Visits: 0
Hello All,

Greeting for the day.

We are observing lots of logs for event ID 521. Below is the message:

521InformationSystem EventClassic294039810Securitycomuptername.localUnable to log events to security log:
Status code: 0x80000005
Value of CrashOnAuditFail: 0
Number of failed audits: 1



I have below concerns:

1. What is the meaning of 0x80000005, I checked windows event ID 521 on this site, there is no status code as 0x80000005.
2. How do I fix it?


Regards,
Ameer Mane
Post #7382
Posted 7/11/2017 3:04:51 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 206, Visits: 0
This equates to STATUS_BUFFER_OVERFLOW The data was too large to fit into the specified buffer as specified here: https://msdn.microsoft.com/en-us/library/cc704588.aspx.

I have experienced events of this type when the event rate was too high on a single source. I would check the available memory and the quantity of events that were being generated. You may want to fine tune your audit policy and see if that helps.
Post #7384
Posted 7/13/2017 8:30:47 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 4/22/2017 9:11:25 AM
Posts: 3, Visits: 0
Hello,

Greetings!!!

Thanks for the reply.

Can you please let me know exactly what should I check in audit policy?
Or, is there any other solution e.g. increasing space or something?

Regards,
Ameer Mane
Post #7385
Posted 8/14/2017 4:47:34 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 206, Visits: 0
Only you can decide what you should be auditing. You can look into some standards like the CIS benchmarks for the OS of the log source. This is a good starting point for what to log.
Post #7397
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:35pm