I would like to confirm the impact of the WARNING message displayed during audit log acquisition on audit log acquisition.

Question

On a Windows server, when I was using the Search-UnifiedAuditLog command to retrieve audit logs, I received the message "WARNING: An error occurred during the search process that may affect the validity of the data." I would like to know if this message affects the audit logs I was retrieving.

Answer 1

Hi @廣谷 信明

Thank you for reaching out. Regarding the error message 'WARNING: An error occurred during the search process that may affect the validity of the data.' when using the Search-UnifiedAuditLog command. This message typically indicates that some audit log entries might be missing from the search results. The data you've received is still valid, the warning simply suggests that the search process may not have fully completed, often due to temporary issues like timeouts or service-side delays. 

To help ensure you get the full set of data, here are a few things you can try: 

1. Rerun the command: Sometimes this warning is just a temporary hiccup. Waiting a few minutes and running the command again usually helps. 
2. Narrow down the search scope: Try shortening the time range or filtering by specific operations or users. This reduces the data volume and helps avoid timeouts. 
3. Break up the search: If you need to search over a long period, try breaking it down into smaller searches. For example, instead of searching for 30 days, you can do 3 searches of 10 days each. 

We hope this information is helpful to you. If the issue persists, feel free to share the exact command you're using and any relevant parameters, we’ll be happy to assist further. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello,

I am sorry, but in my opinion there is a lack of resources behind Purview. Whether you try via the GUI or via PowerShell, the results are not returned or are missing. Trying to cut it into pieces does not change anything. It is not really operational.