Error occurred during logs collection for domain: Process timeout has expired. For more information, please contact Netwrix technical support.

Email It to Me Print this Page
Symptoms You get the following error in the summary report:
"Error occurred during logs collection for <Domain name> domain: Process timeout has expired. For more information, please contact Netwrix technical support."
Cause The product can collect security event logs from Domain Controllers suing one of the following ways:
  • without timeout LogCollectorVersion =1   (default value)
  • with timeout LogCollectorVersion = 2   (enable collecting logs in the separate process)

The LogCollectorVersion registry key can be found in:
  • Windows x32: HKEY_LOCAL_MACHINE -> SOFTWARE ->NetWrix ->AD Change Reporter->%Your domain node%->LogCollectorVersion
  • WIndows x64: HKEY_LOCAL_MACHINE -> SOFTWARE ->Wow6432Node->NetWrix ->AD Change Reporter->%Your domain node%->LogCollectorVersion
  1. When LogCollectorVersion is set to 2, the product starts collecting security logs from Domain Controllers with a timeout (30 minutes by default). If the security logs collecting process takes more than 30 minutes the product skips this Domain Controller and displays the error in the summary report. 
 
Resolution In order to resolve this issue try one of the following solutions:
  • Set LogCollectorVersion key to the default value - 1, to start collecting logs without timeout. Navigate to the registry key:
    • Windows x32: HKEY_LOCAL_MACHINE -> SOFTWARE ->NetWrix ->AD Change Reporter->%Your domain node%->LogCollectorVersion
    • Windows x64: HKEY_LOCAL_MACHINE -> SOFTWARE ->Wow6432Node->NetWrix ->AD Change Reporter->%Your domain node%->LogCollectorVersion 
  • Increase timeout for collecting security logs from Domain Controllers. To do it, perform the following steps: 
  1. Open the registry and navigate to the Netwrix Auditor node.
    • Windows x32: HKEY_LOCAL_MACHINE -> SOFTWARE ->NetWrix ->AD Change Reporter->%Your domain node%
    • WIndows x64: HKEY_LOCAL_MACHINE -> SOFTWARE ->Wow6432Node->NetWrix ->AD Change Reporter->%Your domain node% 
  2. Create the following registry key with next values: CollectLogsTimeout (dword : 32) =43200000 (DECIMAL), 43200000ms = 12 hours
Re-run data collection to check the issue has resolved.

If the issue continues to appear:
  1. Set registry key Tracelevel to 31 (Decimal). Navigate to the registry key:
    • Windows x32: HKEY_LOCAL_MACHINE -> SOFTWARE ->NetWrix ->AD Change Reporter->
    • Windows x64: HKEY_LOCAL_MACHINE -> SOFTWARE ->Wow6432Node->NetWrix ->AD Change Reporter->
  2. Wait for the next data collection and send us the whole Tracing folder from the Netwrix Auditor installation directory
  3. Create a support ticket with details on our website (http://www.netwrix.com/support_ticket.html)
Was this information helpful?