521
Security
System Event
Unable to log events to security log:
Status code: 0xc0000008
Value of CrashOnAuditFail: 0
Number of failed audits: 103
We received this event after generating hundreds of millions of events on a test machine running Windows Server 2008 R2. After about 3 billion events were written, the system eventually stopped logging the actual events, and instead just kept logging event 521. There was no disk space issue, and the log was configured to overwrite events as needed. Clearing the log did not help.
The issue was resolved by rebooting the system.