Return
-
Title
Change Auditor Agent stopping after starting or running but not recording events -
Description
The Change Auditor Agent is running but is not recording events such as Active Directory or Windows File System events.
The following errors are recorded in the ChangeAuditor Agent log files:2015-04-01 12:32:21.297 [1304][ERROR][CFileSystemSink::UpdateConfiguration(221)] Plug-in filter config result: 12015-04-01 12:32:21.328 [1304][ERROR][CFileSystemSink::UpdateConfiguration(246)] Plug-in protection config result: 12015-04-01 12:32:30.018 [1304][WARN][CServerControlHandler::TriggerHooking(146)] LDAP control hooking failed: 0x00000022In addition, the ChangeAuditor agent service may fail start. The following may be recorded in the ChangeAuditor agent logs:
2015-04-07 14:51:48.484 [6592][ERROR][CLsaHook::Inject(276)] Support Dll initialization error (NetProLib::Injection::ScopedVirtualAllocEx::Allocate - Access is denied.) on C:\Program Files\Dell\ChangeAuditor\Agent\CASupport.dll2015-04-07 14:51:48.484 [2908][ERROR][CSamEventSink::WorkerMain(953)] ChangeAuditor utility dll failed to install2015-04-07 14:51:48.593 [6100][WARN][TrogdorLib::Common::CTrogdorService::StartImpl(182)] Error initializing sub-system {SAM Event Sink (27)}.2015-04-07 14:51:48.593 [6100][ERROR][CMonitorService::OnStartFailed(506)] Failed to initialize some threads and sub-systems.
Sign In Required
You need to be signed in and under a current maintenance contract to view premium knowledge articles.