"

Netwrix Auditor System Health Log – eventID 1008

Last review: May 05, 2014
https://kb.netwrix.com/244
Copy Article URL Copied

Netwrix Auditor System Health Log contains the following EventID
1008 – “Automatic Netwrix Auditor Agent for SharePoint deployment failed.” 

This can be due to a number of reasons. Refer to the table below for possible causes and workarounds:

Event Description Reason Solution
Fatal error during installation. The “Timeout expired error” is returned after the agent installation has taken more than 10 minutes.  For instructions on how to resolve the issue, refer to the following Knowledge Base article: The “Timeout Expired” error is returned on Netwrix Auditor Agent for SharePoint deployment.
An invalid SharePoint Central Administration URL was specified on Managed Object creation. Specify this URL in SharePoint Central Administration –> Alternate Access Mapping and force data collection:

  • Navigate to your SharePoint Managed Object and click Run.
An invalid SharePoint Central Administration server was specified on Managed Object creation. The specified server does not belong to the audited farm. Check the name of the computer where the agent must be deployed.

  • Navigate to your SharePoint Managed_Object –> SharePoint, click Configure Options and specify a valid computer name.

Then force data collection.

A SharePoint solution or the agent has already been installed in the SharePoint farm, but the solution has not been deployed yet.  Make sure that the list of installed programs on the target computer does not contain Netwrix Auditor Agent, and uninstall it if it does. If not, open the SharePoint Central Administration site and navigate to System Settings à Manage farm solutions. Locate the “netwrix.sharepoint.audit.wsp” solution and delete it. Then force data collection.
The Data Processing Account does not have the required rights and permissions for automatic agent deployment.  Specify a different Data Processing Account for this monitoring plan:

SQL Server 2012 is installed locally on the computer where SharePoint Central Administration is running, or the default Security settings for user NT AUTHORITYSYSTEM have been modified on SQL Server 2008 (the sysadmin role was removed).  Grant this user the sysadmin permissions, or grant the necessary permissions to the system account. On the SharePoint Server execute the following command in SharePoint Management Shell: Add-SPShellAdmin –UserName “NT AUTHORITYSYSTEM”
SharePoint Central Administration is not functioning properly due to connection problems with the SharePoint Configuration Database, or some other unexpected error. Make sure SharePoint Central Administration is functioning properly.
SharePoint Central Administration URL has been specified without a port number (event description will read: “Fatal error during installation”).  Make sure that you specified a valid Central Administration URL:

  • Navigate to your SharePoint Managed_Object –> SharePoint, click Configure Options and verify Central Administration URL. 

Then force data collection.
If the URL is invalid, recreate the Managed Object and specify a valid URL.

Unable to connect to the remote server. An invalid SharePoint Central Administration port has been specified. Make sure that you specified a valid Central Administration URL:

  • Navigate to your SharePoint Managed_Object –> SharePoint, click Configure Options and verify Central Administration URL. 

Then force data collection.
If the URL is invalid, recreate the Managed Object and specify a valid URL.

The port of SharePoint Central Administration is blocked in the Windows Firewall settings on the target computer, or on the computer where Netwrix Auditor is installed. Check your Windows Firewall settings.
The computer that hosts SharePoint Central Administration is not reachable.  Make sure that there is network connection to this computer.
The remote name could not be resolved. An invalid SharePoint Central Administration host has been specified.  Make sure that you specified a valid Central Administration URL:

  • Navigate to your SharePoint Managed_Object –> SharePoint, click Configure Options and verify Central Administration URL. 

Then force data collection.
If the URL is invalid, recreate the Managed Object and specify a valid URL.

The network path was not found. The target server for agent deployment has been specified incorrectly.  Modify the target server name:

  • Navigate to your SharePoint Managed_Object –> SharePoint, click Configure Options and specify a valid computer name.
Access is denied. The Data Processing Account under which agent installation is performed does not have the required rights and permissions on the target server.  Specify a different Data Processing Account for this monitoring plan:

The system cannot find the file specified. The target server for agent deployment has been specified as an alias that is not specified in the DNS and that cannot be authenticated on the local admin share (\%alias”admin$) on the computer where the agent is to be deployed. Specify a valid server name or IP address:

  • Navigate to your SharePoint Managed_Object –> SharePoint, click Configure Options and specify a valid computer name.

Then force data collection.

The pipe has been ended. The computer that hosts SharePoint Central Administration was restarted or shut down during automatic agent deployment.
Unable to install Netwrix Auditor for SharePoint Core Service on the target server. 
Retry installation.

To retry automatic installation, force data collection.

Go Up