Windows Server 2000
Windows 2003 and XP
The audit log was cleared
On this page
Event 517 is logged whenever the Security log is cleared, REGARDLESS of the status of the Audit System Events audit policy.
The Primary User Name and Client User Name fields will identify the user who cleared the log. Primary User Name will correspond to the system, and Client user name will indicate the user who cleared the log.