Server 2012 - Unable To Log Event To Security Log event id 521

i have logging server logs of our server events on our 2nd domain controller server2012 vm. started seeing constant flow of these errors.  status code 0x80000005, translates a status_buffer_overflow per table http://msdn.microsoft.com/en-us/library/cc704588.aspx

i have option of overwrite log when full.

any on cause or how fix this?

xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><system><provider name='security'/><eventid qualifiers='0'>521</eventid><level>information</level><task>system event</task><keywords>audit success</keywords><timecreated systemtime='2013-11-06t19:10:54.000000000z'/><eventrecordid>108884221</eventrecordid><channel>security</channel><computer>corp-dc2</computer><security userid='nt authority\system'/></system><eventdata>unable log events security log:
     status code:        0x80000005
     value of crashonauditfail:    0
     number of failed audits:    1
</eventdata></event>

hi,

please check security log file size. meanwhile, run event viewer mmc snap-in, select security log, right-click , click properties. in log properties, check log file size set. (security logs recommended set 128-256mb). did actual used security log file size less size set?

this caused corrupt security event log. please rename security event log. restart server re-create new security event log. please check if issue can solved.

by way, there many similar questions solve issue rebooting server. please have reference.

event id: 521 source: security

http://www.eventid.net/display-eventid-521-source-security-eventno-6867-phase-1.htm

hope helps.

best regards,

justin gu

Windows Server  >  Windows Server 2012 General