Netwrix Auditor System Health Log - eventID 1008 / 1208

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the Event ID and provides resolution.
Email It to Me Print this Page
Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1208 - "Automatic Netwrix Auditor for SharePoint Core Service deployment failed"
Netwrix Auditor 8.5 and below: 1008 - 
"Automatic Netwrix Auditor Agent for SharePoint deployment failed.

This can be due to a number of reasons. Refer to the table below for possible causes and workarounds:
 
Event DescriptionReasonSolution
Fatal error during installation.The "Timeout expired error" is returned after Core Service (Agent in Netwrix Auditor 8.5 and below) installation has taken more than 10 minutes. 
 
For instructions on how to resolve the issue, refer to the following Knowledge Base article: The "Timeout Expired" error is returned on Netwrix Auditor Agent for SharePoint deployment.
An invalid SharePoint Central Administration URL was specified on Managed Object creation.Specify this URL in SharePoint Central Administration --> Alternate Access Mapping and force data collection. Do one of the following, depending on your Netwrix Auditor version:
  • For Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit and click Update.
  • For Netwrix Auditor  8.5 and below: navigate to your SharePoint Managed Object and click Run.
An invalid SharePoint Central Administration server was specified on Managed Object creation. The specified server does not belong to the audited farm.Check the name of the computer where the Core Service (Agent in Netwrix Auditor  8.5 and below) must be deployed. 
Do one of the following, depending on your Netwrix Auditor version:
  • Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> Core Service and update the name of the server that hosts SP Central Administration. 
  • Netwrix Auditor 8.5 and below: navigate to your SharePoint Managed_Object --> SharePoint, click Configure Options and specify a valid computer name.
Then force data collection.
A SharePoint solution or a Netwrix Auditor Core Service (Agent in Netwrix Auditor 8.5 and below) has already been installed in the SharePoint farm, but the solution has not been deployed yet. Make sure that the list of installed programs on the target computer does not contain Netwrix Auditor Core Service (Agent in Netwrix Auditor 8.5 and below), and uninstall it if it does. If not, open the SharePoint Central Administration site and navigate to System Settings à Manage farm solutions. Locate the “netwrix.sharepoint.audit.wsp” solution and delete it. Then force data collection.
The Data Processing Account does not have the required rights and permissions for automatic agent deployment. Specify a different Data Processing Account for this monitoring plan. Do one of the following, depending on your Netwrix Auditor version:
For Netwrix Auditor 9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> General and enter name and password for a custom account.
For Netwrix Auditor 8.5 and below: right-click the Managed Object and select Properties), or grant the current account the necessary rights and permissions (for a full list of permissions refer to the Netwrix Auditor Online Help Center https://helpcenter.netwrix.com/Configure_IT_Infrastructure/Accounts/Configure_Data_Collecting_Account.html)
SQL Server 2012 is installed locally on the computer where SharePoint Central Administration is running, or the default Security settings for user NT AUTHORITY\SYSTEM have been modified on SQL Server 2008 (the sysadmin role was removed). Grant this user the sysadmin permissions, or grant the necessary permissions to the system account. On the SharePoint Server execute the following command in SharePoint Management Shell: Add-SPShellAdmin –UserName “NT AUTHORITY\SYSTEM”
SharePoint Central Administration is not functioning properly due to connection problems with the SharePoint Configuration Database, or some other unexpected error.Make sure SharePoint Central Administration is functioning properly.
SharePoint Central Administration URL has been specified without a port number (event description will read: "Fatal error during installation"). Make sure that you specified a valid Central Administration URL.
Do one of the following, depending on your Netwrix Auditor version:
  • Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> General and verify Central Administration URL. 
  • Netwrix Auditor 8.5 and below: navigate to your SharePoint Managed_Object --> SharePoint, click Configure Options and verify Central Administration URL. 
Then force data collection.
If the URL is invalid, recreate the monitoring plan / Managed Object and specify a valid URL.
Unable to connect to the remote server.An invalid SharePoint Central Administration port has been specified.Make sure that you specified a valid Central Administration URL.
Do one of the following, depending on your Netwrix Auditor version:
  • Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> General and verify Central Administration URL. 
  • Netwrix Auditor 8.5 and below: navigate to your SharePoint Managed_Object --> SharePoint, click Configure Options and verify Central Administration URL. 
Then force data collection.
If the URL is invalid, recreate the monitoring plan / Managed Object and specify a valid URL.
The port of SharePoint Central Administration is blocked in the Windows Firewall settings on the target computer, or on the computer where Netwrix Auditor is installed.Check your Windows Firewall settings.
The computer that hosts SharePoint Central Administration is not reachable. Make sure that there is network connection to this computer.
The remote name could not be resolved.An invalid SharePoint Central Administration host has been specified. Make sure that you specified a valid Central Administration URL.
Do one of the following, depending on your Netwrix Auditor version:
  • Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> General and verify Central Administration URL. 
  • Netwrix Auditor 8.5 and below: navigate to your SharePoint Managed_Object --> SharePoint, click Configure Options and verify Central Administration URL. 
Then force data collection.
If the URL is invalid, recreate the monitoring plan / Managed Object and specify a valid URL.
The network path was not found.The target server for agent deployment has been specified incorrectly. Modify the target server name. Do one of the following, depending on your Netwrix Auditor version:
  • Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> Core Service and update the name of the server that hosts SP Central Administration. 
  • Netwrix Auditor 8.5 and below: navigate to your SharePoint Managed_Object --> SharePoint, click Configure Options and specify a valid computer name.
Access is denied.The Data Processing Account under which agent installation is performed does not have the required rights and permissions on the target server. Specify a different Data Processing Account for this monitoring plan. Do one of the following, depending on your Netwrix Auditor version:
For Netwrix Auditor 9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> General and enter name and password for a custom account.
For Netwrix Auditor 8.5 and below: right-click the Managed Object and select Properties), or grant the current account the necessary rights and permissions (for a full list of permissions refer to the Netwrix Auditor Online Help Center https://helpcenter.netwrix.com/Configure_IT_Infrastructure/Accounts/Configure_Data_Collecting_Account.html)
The system cannot find the file specified.The target server for agent deployment has been specified as an alias that is not specified in the DNS and that cannot be authenticated on the local admin share (\\%alias"\admin$) on the computer where the agent is to be deployed.Specify a valid server name or IP address. 
Do one of the following, depending on your Netwrix Auditor version:
  • Netwrix Auditor  9.0 and above: navigate to your SharePoint monitoring plan --> Edit Item --> Core Service and update the name of the server that hosts SP Central Administration. 
  • Netwrix Auditor 8.5 and below: navigate to your SharePoint Managed_Object --> SharePoint, click Configure Options and specify a valid computer name.
Then force data collection.
The pipe has been ended.The computer that hosts SharePoint Central Administration was restarted or shut down during automatic agent deployment. 
Unable to install Netwrix Auditor for SharePoint Core Service on the target server. 
Retry installation.

To retry automatic installation, force data collection. 

 
Was this information helpful?