Netwrix Auditor System Health event log contains the following Event ID: 1275
“The Netwrix Auditor for SharePoint Core Service must have been removed”.
Note: If the Event ID appears in the log after upgrade, ignore it; it does not affect the product functionality.
The Netwrix Auditor for SharePoint Core Service has been manually removed from the computer that hosts SharePoint Central Administration.
- If you selected to deploy the Netwrix Auditor for SharePoint Core Service automatically, Netwrix Auditor will install the service on the next data collection. In order to run the data collection, navigate to you SharePoint monitoring plan > Edit and select Update in the right pane.
- If you selected to install the Netwrix Auditor for SharePoint Core Service manually, refer to https://helpcenter.netwrix.com/Installation/Install_Core_Service_SharePoint.html for detailed instructions.