The Change Auditor Agent is running but is not recording events such as Active Directory or Windows File System events.
The following errors are recorded in the ChangeAuditor Agent log files:
2015-04-01 12:32:21.297 [1304][ERROR][CFileSystemSink::UpdateConfiguration(221)] Plug-in filter config result: 1
2015-04-01 12:32:21.328 [1304][ERROR][CFileSystemSink::UpdateConfiguration(246)] Plug-in protection config result: 1
2015-04-01 12:32:30.018 [1304][WARN][CServerControlHandler::TriggerHooking(146)] LDAP control hooking failed: 0x00000022
In addition, the ChangeAuditor agent service may fail start. The following may be recorded in the ChangeAuditor agent logs:
2015-04-07 14:51:48.484 [6592][ERROR][CLsaHook::Inject(276)] Support Dll initialization error (NetProLib::Injection::ScopedVirtualAllocEx::Allocate - Access is denied.) on C:\Program Files\Dell\ChangeAuditor\Agent\CASupport.dll
2015-04-07 14:51:48.484 [2908][ERROR][CSamEventSink::WorkerMain(953)] ChangeAuditor utility dll failed to install
2015-04-07 14:51:48.593 [6100][WARN][TrogdorLib::Common::CTrogdorService::StartImpl(182)] Error initializing sub-system {SAM Event Sink (27)}.
2015-04-07 14:51:48.593 [6100][ERROR][CMonitorService::OnStartFailed(506)] Failed to initialize some threads and sub-systems.