Event ID 521 - critical logging failure on Domain Controllers

Recently we started recording large volumes of event ID 521 on all of our domain controllers.

The log data:

EventID: 521

Event Data: unable to log events to the security log

Status code: 0x80000005

Value of CrashonAuditFail: 0

Number of failed audits: 1

All domain controllers have sufficient disk space to write to the log, and the logs are configured to overwrite the oldest events first.

Servers have been restarted but the issue remains.

The domain controllers are writing other events to the security event log, the event occurs for a small portion of events.

We are recording ~61.34k of these events a day.

Any pointers would be appreciated.

The 0x80000005 status code in the event description means "access denied". So it is possible that some application is trying to record events in the security log but it doesn't have the required permissions (for more reasons for an "access denied" error see http://www.eventid.net/errorsdisplay.asp?error_code=5 - sometimes the message is deceiving). A corrupted log would cause a status code of 0xc0000008 (Invalid handle) so I don't think that's the case here.

Based on the number of events that you mentioned and assuming that the 19 DCs have a similar number of events recorded, it looks like this event is recorded every 30 seconds? Can you verify that? If that's not the case, what is the frequency of the 521 events?