You would like to audit Microsoft SQL Server using Change Auditor but it does not work even after everything has been properly configured.
When looking at the Change Auditor Agent log on the SQL Server, you notice the following error:
Seemingly, the SQL Server installation did not create the WMI object for event tracing or the WMI class has been somehow destroyed.
This issue is not caused by Change Auditor as far as we know. It is related to Microsoft SQL event tracing. In this particular scenario the only difference between working servers and non-working servers was that the non-working servers experienced an in-place upgrade of Microsoft SQL Server or Windows Server OS. Potentially, the WMI class got lost in this process.
The below steps confirms is MSSQLSERVERTRACE object is available or not
1.Run wbemtest as administrator
2. Click the connect button, change the namespace to root/wmi, and click on connect button
3.Now that you are connected to WMI, click the Enum classes button. type EventTrace as the superclass name, and click ok (This method will list objects alphabetically)
4. Or click the query button and type the following query, select * from meta_class where __superclass = "EventTrace" (This method doesn't list objects alphabetically)
5. Look for an EventTrace object called MSSQLSERVERTrace (name of the instance and Trace is appended).
6. If you cannot find the MSSQLSERVERTrace object, the object has been lost or destroyed and SQL Server must be repaired. This is the right way to fix the issue
