AU.2.004 — Alert on Audit Logging Process Failure

What AU.2.004 means in plain English

If your logging system breaks—the log file fills up, Windows stops recording events, or M365 audit gets accidentally turned off—you need to know about it right away, not three months later during an assessment. Set up a simple alert so that if logging stops or the log becomes full, someone gets an email or sees a Windows alert. Otherwise you could have a gap in your audit trail and not realize it.

The assessment question

“Is there an automated or procedural mechanism in place to alert designated personnel when audit logging fails or audit logs reach capacity, with evidence of the alerting configuration?”

How to implement AU.2.004

1. In Windows Event Viewer, configure the Security log to send an alert when it reaches a size threshold: right-click Security log > Properties > set the log size limit and choose "Archive the log when full." Then create a Windows Task Scheduler task that triggers on Event ID 1104 (Security audit log was cleared) and sends an email or creates a desktop notification.
2. For Microsoft 365: go to Microsoft Purview Compliance Portal > Alerts > Create alert policy. Create a policy that fires if audit logging is disabled or if there is unusual activity. Route the alert to the owner or IT-responsible person.
3. If you use a SIEM or log aggregator (even the free Wazuh), configure a rule that alerts when no new events are received from a monitored source for more than 24 hours—this catches silent failures.
4. Test the alert annually: temporarily pause logging on a test machine, confirm the alert fires, then re-enable logging. Document the test result.
5. Write a one-paragraph procedure describing what to do when an alert is received: who is notified, what they check, how quickly they must respond.

Evidence your assessor will ask for

• Screenshot of Windows Event Log size/archive configuration
• Screenshot or export of Task Scheduler task configured to alert on Event ID 1104 or log-full condition
• Microsoft Purview alert policy configuration screenshot (if using M365)
• Documentation of annual alert test with results
• Written procedure for responding to audit logging failure alerts

More Audit & Accountability controls