Skip to main content

Error: Netwrix Auditor for File Servers Audit Service Terminated Unexpectedly

Symptoms​

  1. Error message:
The Netwrix Auditor for File Servers Audit Service terminated unexpectedly

  1. After two restarts it crashes the server

  2. An application log shows the following issues:

  • nwcoresvc.exe
  • Netwrix.ADA.EventCollector.exe
  • Netwrix.O365.AdminAuditLogCollector.exe
  • Application: Netwrix.ADA.SitServiceUpdater.exe
  • Application: Netwrix.ADA.BackwardDataAnalyzer.exe
  • Netwrix.ADA.DirSyncCollector.exe

Resolution​

If you are currently on a 10.5 version and build other than 10950, perform the procedure below.

  1. Stop Netwrix Auditor for File Servers Audit Service
  2. Find the FileStorageAuditor folder in Working Folder and delete it or rename it to FileStorageAuditor.Old

TIP: The default location of Working folder is C:\ProgramData\Netwrix Auditor. If it does not appear on the default location you may check it at Netwrix Dashboard: Health Status > Working Folder > Open diagnostic logs folder and go one folder back on the prompted location

  1. Delete the memory dump files from C:\Windows\Temp\ generated by crashes
  2. Upgrade to a new build
  3. Start Netwrix Auditor for File Servers Audit Service
  4. Run a Data Collection by selecting update on the monitoring plan