V 2.0 : EVID 521 : Failed Writing Audit Logs

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=521

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55

V 2.0 : EVID 521 : Failed Writing Audit Logs

Base Rule

General Audit Failure

Ops/Error

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Level

<severity>

String/Number/Text

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Data

<responsecode>

Text/String

Status code representing the reason for the error. Codes can be found here:

Data

Value of CrashOnAuditFail

Data

<quantity>

Number

Number of failed audit writes