A Domain Controller with a SQL Server installed causes the Change Auditor agent to use 100% CPU. (4306528)

On a Domain Controller with SQL Server and the Change Auditor agent installed, the CPU maxes out at 100% when the agent is enabled and drops to 5% when the agent is disabled.

Quest Support does not recommend running a Domain Controller with Microsoft SQL Server also installed on it. Please make all efforts to keep your SQL Server installations off of your Domain Controllers.

If the agent is configured to audit the SQL Server you may see the following events in the log:

[INFO][CSQLSink::OnConfigurationChanged(326)] Monitoring all SQL instances...: and a very large list SQL events being monitored.

The agent database has lots of events in it, as evidenced by the agent log entry:

[WARN][TorzagLib::Agent::CAgentDatabaseAccess::DatabaseSuspended(321)] Suspend: Database size = 3151298560

The Coordinator log may have the following entries indicating that it cannot connect to the database:

[INFO][Quest.Data.ExceptionSql.OnExceptionSqlEvent(0)] SQL error(10054): A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.); command: sp_getapplock

[WARN][ChangeAuditor.Coordinator.SqlReconnectTask.ExceptionSql_ExceptionSqlEvent(0)] Attempting to reconnect to the database (1).

[INFO][Quest.Data.ExceptionSql.OnExceptionSqlEvent(0)] SQL error(-2146232060): A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 - The specified network name is no longer available.); command: np_SystemPropertyBoolGet

[INFO][Quest.Data.ExceptionSql.OnExceptionSqlEvent(0)] SQL error(64): A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 - The specified network name is no longer available.); command: sp_getapplock

[ERROR][ChangeAuditor.Coordinator.SqlReconnectTask.ExceptionSql_ExceptionSqlEvent(0)] SQL connection lost. Connections will be dropped and coordinator will attempt to reconnect

The database server the Coordinator is trying to connect to is the DC/SQL server where the agent is installed as per:

[INFO][ChangeAuditor.Sys.DataAccess.Connect(0)] Opening ChangeAuditor database: Data Source='DC name';Initial Catalog=ChangeAuditor;Integrated Security=False;User ID=sa;Application Name="ChangeAuditor Coordinator on 'Coordinator server name'"

Change Auditor is auditing the Change Auditor database along with all other databases on a SQL Server installed on a Domain Controller and the installed agent is consuming 95% of the available CPU.

Quest Support does not recommend auditing the Change Auditor database, as this will create a never ending loop of event audits.

Please note: If you have a Change Auditor version prior to 6.9.5, any folder/registry paths referenced may contain a non-Quest branded path.

1. First ensure there are no connection problems between the Coordinator and DC/SQL machine.

2. If there are no obvious problems with the network, try shutting down the CA agent and check coordinator log files to see if the connection to the db is restored.

3. If the Coordinator reconnects to the database on the DC/SQL server the we know the agent CPU is the problem. Try disabling the SQL auditing on that agent and try starting the agent up and observe the

4. If disabling the SQL auditing does not help, try renaming the agent local db and restoring the one from the backup (C:\Program Files\Quest\ChangeAuditor\Agent\Backup) and start the agent again and observer the results.