Netwrix Auditor data collection is running longer than 20 hours

This article explains how to restart the scheduled task if your data collection is running too long.
Email It to Me Print this Page
Symptoms

Netwrix Auditor data collection is running longer than 20 hours. 

Cause

The most common reason is the number of events and/or objects on the target server.

Resolution

Navigate to Start → Administrative Tools → Task Scheduler and follow the corresponding resolution prompts depending on your Netwrix Auditor version:

  • For Netwrix Auditor 7.0 and above:
  1. Locate the Netwrix Auditor {850fe1da-0ea6-c1a8-9810-0c1cece30698} <your_Managed_Object_GUID>* task.
  2. Right-click the task and select End. Make sure that the process has stopped.
  3. In Netwrix Auditor Administrator Console, navigate to Managed Objects → your_File_Server_Managed_Object_name → File Servers and select Configure next to Audit Trail Settings. In the Audit Trail Settings dialog, select Basic Mode.
  4. In Task Scheduler, right-click the task you have ended on the step 1 and run it.
  • For Netwrix Auditor 6.5 and below:
  1. Locate the Netwrix File Server Change Reporter task.
  2. Right-click the task and select End. Make sure that the process has stopped.
  3. In Netwrix Auditor console, navigate to Managed Objects → your_File_Server_Managed_Object_name → File Servers and select Configure next to Audit Trail Settings. In the Audit Trail Settings dialog, select Enable large server support.
  4. In Task Scheduler, right-click the task you have ended on the step 1 and run it.
If the steps above do not resolve the issue, contact Netwrix Technical Support.

*To view your Managed Object GUID, navigate to %programdata%\Netwrix Auditor\Audit Core\Config Server\Configuration.xml. Find your Managed Object name in the configuration file:

-<n n="ManagedObjects">
....
<a n="Name" t="2" v="your_SharePoint_Managed_Object_name"/>

Was this information helpful?