Netwrix Auditor data collection is running longer than 20 hours

Setup and Configuration
6.5 and older
7.0-8.5
https://kb.netwrix.com/1151
Copy Article URL Copied

Netwrix Auditor data collection is running longer than 20 hours.


The most common reason is the number of events and/or objects on the target server.


Navigate to Start → Administrative Tools → Task Scheduler and follow the corresponding resolution prompts depending on your Netwrix Auditor version:

  • For Netwrix Auditor 7.0 and above:
  1. Locate the Netwrix Auditor {850fe1da-0ea6-c1a8-9810-0c1cece30698} <your_Managed_Object_GUID>* task.
  2. Right-click the task and select End. Make sure that the process has stopped.
  3. In Netwrix Auditor Administrator Console, navigate to Managed Objects → your_File_Server_Managed_Object_name → File Servers and select Configure next to Audit Trail Settings. In the Audit Trail Settings dialog, select Basic Mode.
  4. In Task Scheduler, right-click the task you have ended on the step 1 and run it.
  • For Netwrix Auditor 6.5 and below:
  1. Locate the Netwrix File Server Change Reporter task.
  2. Right-click the task and select End. Make sure that the process has stopped.
  3. In Netwrix Auditor console, navigate to Managed Objects → your_File_Server_Managed_Object_name → File Servers and select Configure next to Audit Trail Settings. In the Audit Trail Settings dialog, select Enable large server support.
  4. In Task Scheduler, right-click the task you have ended on the step 1 and run it.

If the steps above do not resolve the issue, contact Netwrix Technical Support.

*To view your Managed Object GUID, navigate to %ProgramData%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your Managed Object name in the configuration file:

-<n n=”ManagedObjects”>
….
<a n=”Name” t=”2″ v=”your_SharePoint_Managed_Object_name”/>

Go Up