Netwrix Auditor System Health Log - eventID 1075 / 1275

This article applies to Netwrix Auditor 6.0 and above. It explains the nature of the eventID and provides resolution.
Email It to Me Print this Page
Symptoms Depending on your Netwrix Auditor version, the Netwrix Auditor System Health Log contains the following EventID
Netwrix Auditor 9.0 and above: 1275 "The Netwrix Auditor for SharePoint Core Service must have been removed".
Netwrix Auditor 8.5 and below: 1075 "The Netwrix Auditor Agent for SharePoint must have been removed".

Note: If this eventID appears in the log after upgrade, ignore it; it does not affect the product functionality.
Cause The Netwrix Auditor for SharePoint Core Service (Agent for Netwrix Auditor 8.5 and below) has been manually removed from the computer that hosts SharePoint Central Administration.
Perform the following resolution steps, depending on your current Netwrix Auditor version:
Netwrix Auditor 9.0 and aboveNetwrix Auditor 8.5 and below
  • If you selected to deploy the Netwrix Auditor for SharePoint Core Service automatically, Netwrix Auditor will install the service on the next data collection. To run data collection, navigate to you SharePoint monitoring plan -> Edit and select Update in the right pane.
  • If you selected to install the Netwrix Auditor for SharePoint Core Service manually, refer to for detailed instructions.
    Was this information helpful?