Unable to Log Events to Security Logs Event ID 521
In this article
Issue description
Prerequisites
Possible causes
Resolution
Related topics and articles
How to reach support
Issue description
Event ID 521 is generated when the system fails to write audit events to the Security Log. This typically indicates a serious problem with the auditing mechanism on the system. When this event occurs, critical audit data might be lost, impacting security monitoring, forensic investigations, and compliance requirements. It is essential to resolve this promptly to restore reliable audit logging.
Prerequisites
ADAudit Plus service account or local system account if used should have the Manage auditing and security log privilege.
Ensure the Windows Event Log service is running and set to Automatic startup.
Ensure no conflicting Group Policies restrict security logging or overwrite settings.
Possible cause s
The Security log is full and set to not overwrite events.
Insufficient permissions for the audit process to write to the log.
Corruption or misconfiguration in the Windows Event Log service.
Group Policy settings that prevent overwriting or managing log sizes.
Resolution
ADAudit Plus requires events to be logged correctly in the Event Viewer. If Event ID 521 is generated, it indicates that the system has failed to log security events resulting in log collection failure. To increase the security log size in the Event Viewer:
Start > run > eventvwr.
Double click Windows Logs > right click > Security > Properties.
Set the Maximum log size (KB): to 4194240 KB which is 4GB.
Click Apply and OK.
Issue: Windows Event Log service is not running
Open Run (Win + R), type services.msc, and press Enter.
Locate the Windows Event Log service, ensure it is running and set to automatic.
If the service is stopped, right-click and start the service.
Related topics and documentation
When and where to reach support
If the issue persists, contact our support team here.
New to ADSelfService Plus?
Related Articles
How can I set up notifications if ADAudit Plus stops collecting event logs?
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective To configure notifications in ADAudit Plus to receive alerts about the product’s performance, failures, and service ...Troubleshooting user creation events not being captured
In this article: Issue description Prerequisites Possible causes Resolution How to reach support Related topics and articles Issue description A new user account is created in Active Directory, but the action is not recorded or visible in any ADAudit ...Troubleshooting last event timestamp showing a future date
In this article: Issue description Prerequisites Possible causes Resolution How to reach support Related topics and articles Issue description Data is not being collected in real time from a specific server. The Last Event Fetched Time in the ADAudit ...Can I import previously generated security logs into ADAudit Plus?
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective Learn how to import EVT/EVTX logs into ADAudit Plus for analysis and auditing by configuring scheduled or one-time imports ...How to restore archived events in ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective To restore archived event data or backed-up Evt/Evtx files in ADAudit Plus so you can access older audit logs for ...