Event Details
User Activity->System Events->Windows 2000-2003->EventID 516 - Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits
EventID 516 - Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits
 Sample:
        Event Type:	Success Audit
        Event Source:	SECURITY
        Event Category:	System Event
        Event ID:	516
        Date:		4/17/2009
        Time:		9:02:10 AM
        User:		N/A
        Computer:	KERMIT
        Description:
        Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. Number of audit messages discarded: 13

        For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
      
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Category System
Source Security
EventId 516
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime
Who Account or user name under which the activity occured. User
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Event records discarded" Event records discarded
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "High" High
WhoDomain -
WhereDomain -
Comments
You must be logged in to comment