Change Auditor for SQL Auditing does not work on SQL Server 2017 (4316101)

You would like to audit Microsoft SQL Server 2017 using Change Auditor but it does not work even after everything has been properly configured.

So far this issue has been encountered with Microsoft SQL Server 2017 / 2019 only.

When looking at the Change Auditor Agent log on the SQL Server, you notice the following error:

Seemingly, the SQL Server installation did not create the WMI object for event tracing or the WMI class has been somehow destroyed.

This issue is not caused by Change Auditor as far as we know. It is related to Microsoft SQL event tracing. In this particular scenario the only difference between working servers and non-working servers was that the non-working servers experienced an in-place upgrade from Microsoft SQL 2016 to Microsoft SQL 2017. Potentially, the WMI class got lost in this process but we cannot tell for sure.

The below steps confirms is MSSQLSERVERTRACE object is available or not

1. Run wbemtest as administrator
2. Click the connect button, change the namespace to root/wmi, and click on connect button
3. Now that you are connected to WMI, click the Enum classes button. type EventTrace as the superclass name, and click ok (This method will list objects alphabetically)
4. Or click the query button and type the following query, select * from meta_class where __superclass = "EventTrace" (This method doesn't list objects alphabetically)
5. Look for an EventTrace object called MSSQLSERVERTrace (name of the instance and Trace is appended).
6. If you cannot find the MSSQLSERVERTrace object you can follow these steps on a different SQL Server.
   
   1. In order to populate WMI with the EventTrace object, we found that a re-installation of Microsoft SQL Server resolved the issue.