Failed To Write To The Audit Log

Microsoft.ActiveDirectoryFederationServices20.FederationServerFailureWritingToAuditLogMonitor (UnitMonitor)

Knowledge Base article:

Summary

An attempt to write an audit to the Security log in Event Viewer failed.

If any AD FS audit has been logged successfully, the monitor will change to a Green state and the original critical alert will be resolved automatically.

Causes

The following are possible causes for this event:

The Security event log service is unavailable.
The Federation Service does not have correct permissions to write to the Security log.

Resolutions

The following are possible resolutions for this event:

Verify in the Services node of Server Manager that the following services are running:
Windows Error Reporting Service
Windows Event Collector
Windows Event Log
Ensure that the Federation Service has the correct permissions to write to the Security log. This includes verifying that the AD FS service account has write permissions to perform auditing. For more information, see "Configure auditing for AD FS" section in the AD FS troubleshooting guide.

Element properties:

Target

Microsoft.ActiveDirectoryFederationServices20.FederationServer

Parent Monitor

System.Health.SecurityState

Category

SecurityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Failed To Write To The Audit Log

An attempt to write to the AD FS Security event log failed.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices20.FederationServerFailureWritingToAuditLogMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices20.FederationServer" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>SecurityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.ActiveDirectoryFederationServices20.FederationServerFailureWritingToAuditLogMonitor_AlertMessageResourceID">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>$Target/Property[Type="Microsoft.ActiveDirectoryFederationServices20.FederationServer"]/ADFSEventLog$</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">207</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <RegExExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>MatchesMOM2005RegularExpression</Operator>

            <Pattern>(^AD FS$)|(^AD FS 2.0$)</Pattern>

          </RegExExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Security</SecondLogName>

    <SecondExpression>

      <RegExExpression>

        <ValueExpression>

          <XPathQuery Type="String">PublisherName</XPathQuery>

        </ValueExpression>

        <Operator>MatchesMOM2005RegularExpression</Operator>

        <Pattern>(^AD FS Auditing$)|(^AD FS 2.0 Auditing$)</Pattern>

      </RegExExpression>

    </SecondExpression>

  </Configuration>

</UnitMonitor>