Skip to main content
Skip table of contents

V 2.0 : EVID 521 : Failed Writing Audit Logs

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 : EVID 521 : Failed Writing Audit LogsBase RuleGeneral Audit FailureOps/Error

Mapping with LogRhythm Schema  

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
Provider N/AN/AIdentifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID<vmid>NumberThe identifier that the provider used to identify the event.
Level<severity>String/Number/TextThe severity level defined in the event.
Task<vendorinfo>Text/StringThe task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Keywords<result>Text/StringA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreated N/AN/AThe time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordID N/AN/AThe record number assigned to the event when it was logged.
Channel N/AN/AThe channel to which the event was logged.
Computer<dname>Text/StringThe name of the computer on which the event occurred.
Data<responsecode>Text/StringStatus code representing the reason for the error. Codes can be found here: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
Data

Value of CrashOnAuditFail
Data<quantity>NumberNumber of failed audit writes


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.