I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm.
I noticed a few weeks back that we had large volumes of this event originating from all of our domain controllers. The log data is as follows:
EventID: 521 Event Data: unable to log events to the security log Status code: 0x80000005 Value of CrashonAuditFail: 0 Number of failed audits: 1
I've ensured that all domain controllers have sufficient disk space to write to the log & that the logs are configured to overwrite the oldest logs first. Servers have been bounced in the last few days but the issue remains.
I have read some suggestions about renaming the security event and restarting the machine so that a new event file is created but I can't believe that the event file has become corrupt on all domain controllers.
It's also worth noting that all of the impacted domain controllers are in fact writing other events to the security event log!
We are getting ~61.34k of these events a day.
Any pointers would be massively appreciated.