Change Auditor non-owner delete events are not generated when an item is deleted through Outlook Web Access (OWA). The issue only occurs in Change Auditor 6.7 with Exchange 2013 CU8 and CU9.
Non-owner delete events are recorded in the Outlook client using MAPI over HTTP. Non-owner open events are recorded when accessing through OWA.
The following is reported in the OWA2Hook log:
2015-09-04 09:35:05.094 [ERROR][ChangeAuditor.Owa2Hook.Owa2Module.__try_process(0)] PrefetchExchangeObjects:
System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> Microsoft.Exchange.Data.Storage.InvalidIdMalformedException ---> System.FormatException: Invalid length for a Base-64 char array or string.
at System.Convert.FromBase64_Decode(Char* startInputPtr, Int32 inputLength, Byte* startDestPtr, Int32 destLength)
at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength)
at System.Convert.FromBase64String(String s)
at Microsoft.Exchange.Data.Storage.ServiceIdConverter.GetDecompressedMemoryStream(String id)
at Microsoft.Exchange.Data.Storage.ServiceIdConverter.ConvertFromConcatenatedId(String id, BasicTypes expectedType, List`1 attachmentIds)
--- End of inner exception stack trace ---