Event ID - 516

Event Id516
SourceSecurity
DescriptionInternal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

Number of audit messages discarded: %1
Event InformationAccording to Microsoft :
Cause :
This event record indicates that audit event records have been discarded, due to overwriting of earlier records or due to cessation of auditing, depending on the audit policy you have established; or by internal event queues exceeding their maximum length.
Reference LinksEvnt ID 516 from Source Security

Alternate Event ID in Vista and Windows Server 2008 is 4612.

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.