Windows 10: Event ID 521, Unable to log events to Security log

​

If you see Event ID 521 along with a message saying Unable to log events to security log on Windows Server, here is how you can fix the problem. It appears when the maximum log size is set to minimum or anything lower than maximum. In order to fix this issue, you need to change […]

This article Event ID 521, Unable to log events to Security log first appeared on TheWindowsClub.com.

read more...

 

Storport/OperationalEventID 520-521-The miniport Logged an event...

I am getting many eventlog errors (Event 500 and 521)
from Microsoft-Windows-Storage-Storport/Operational
The miniport logged an event.

[ Name] Microsoft-Windows-StorPort
[ Guid] {c4636a1e-7986-4646-bf10-7bc3b4a76e8e}
EventID 521
Version 1
Level 2
Task 201
Opcode 0
Keywords 0x800200000000080
- TimeCreated

[ SystemTime] 2019-10-04T11:56:23.641450900Z
EventRecordID 348699
Correlation
- Execution
[ ProcessID] 0
[ ThreadID] 0
Channel Microsoft-Windows-Storage-Storport/Operational

Computer DESKTOP-xxxxxx
Security
- EventData
MiniportName storahci
MiniportEventId 26
MiniportEventDescription AhciPortErrorRecovery
PortNumber 0
Bus 0
Target 0
LUN 0
Parameter1Name StateFlags
Parameter1Value 1106433
Parameter2Name PortErrRecovery
Parameter2Value 41
Parameter3Name StartState
Parameter3Value 1099511627798
Parameter4Name PortReset
Parameter4Value 0
Parameter5Name RunningStrtFail
Parameter5Value 0
Parameter6Name NonQ'dErrRecov
Parameter6Value 40
Parameter7Name NCQError|NCQErrorComplete
Parameter7Value 0
Parameter8Name BusChange
Parameter8Value 0

=

Any suggestions? Have spent quite a while trying to figure out what hardware is involved.

Thanks.

Attachment 250006

 

NTFS Compression on Event Logs

Anyone ever try doing NTFS compression on their Error Logs?
It's all text, so it should compress pretty well.






Anyone else try this? I suppose it's only useful in server-land when you have huge event logs..

To compress:
Run services.msc
Find Event Log and set to "Disabled"
Reboot
Go to c:\windows\system32\config
NTFS Compress anything that ends in .evt
Run services.msc
Find Event Log and set to "Automatic"
Reboot

 

Security Event Log flooded with 4656 Events

We are having issues with our Security event log within Event Viewer. It is my understanding when you perform Object Access auditing and enable it within Group Policy, you still need to enable auditing on the Objects (to be audited) themselves. We just enabled
Object Access auditing and are already seeing Handle Manipulation events (i.e. event id 4656) flooding our Security log even though we have not configured auditing at the file level for ANY of the files in question.
A lot of forums mention disabling Audit File System and Audit Handle Manipulation events to ensure the 4656 events do not flood the Security log; however, we want to be able to see these events for the files that we configure auditing for (at the
file level), but not for any other files which were not configured for auditing at the file level.
We do not have Global Object Access Auditing configured.