Event viewer system log not updating
See the "Application or Security Event Log Choice" section later in this topic.
is not specified, the default log name is "Security" log for the platform supporting writing to the Security log; otherwise, it is "Application" log.
I checked the auditing event to see if they were disabled but they were ok.
Applications created with Windows Communication Foundation (WCF) can log security events (either success, failure, or both) with the auditing feature.
Another option during auditing is whether to suppress any audit failure.
By default, an audit failure does not affect an application.
For more information about WCF security, see Security Overview.
For more information about programming WCF, see Basic WCF Programming. Once you determine an audit level and behavior, you (or an administrator) can specify a location for the audit log.
For more information, see the Microsoft Support article on viewing and managing event logs by using the Event Viewer in Windows XP available at How to view and manage event logs in Event Viewer in Windows XP.The three choices include: Default, Application, and Security.When you specify Default, the actual log depends on which system you are using and whether the system supports writing to the security log.Only the Windows Server 2003 and Windows Vista operating systems support writing to the Security log.For more information, see the "Operating System" section later in this topic.