Kaseya Community

Latest Audit and Disk Corruption

  • Some of our servers are kicking out Event ID 55 NTFS at the same time the latest audit script starts. Is there any way to view the script to look at what it is doing?

    Legacy Forum Name: Latest Audit and Disk Corruption,
    Legacy Posted By Username: buymeagoat
  • buymeagoat
    Some of our servers are kicking out Event ID 55 NTFS at the same time the latest audit script starts. Is there any way to view the script to look at what it is doing?


    in the procedure history you'll see "such and such script failed step whatever" your cursor will change hold the left alt key and click.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: thirteentwenty
  • Each time an audit is run the Kaseya agent analyses every executable file on the disk. If there are any errors on the disk then this may generate the error. You'll probably find that a full virus scan would produce the same result.

    This is a good indicator to run a chkdsk on the machine.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: Bitwise
  • thirteentwenty
    in the procedure history you'll see "such and such script failed step whatever" your cursor will change hold the left alt key and click.


    I'm using Kaseya 2.0. I tried this and it doesn't appear to work. Could you direct me to what part of Kaseya I should be viewing to get this functionality? I'm apparently looking in the wrong place.

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: buymeagoat
  • buymeagoat
    I'm using Kaseya 2.0. I tried this and it doesn't appear to work. Could you direct me to what part of Kaseya I should be viewing to get this functionality? I'm apparently looking in the wrong place.


    in LC, click the "Agent Data" button... you should be on the "Pending Procedures" tab... the bottom half of that page will be "Procedure History"...

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: thirteentwenty
  • I did some further examination using process monitor (procmon). The corruption events are being triggered in the event log (55 and 333) at the very moment Kaseya states the audit ENDS. The corruption events do not occur at the time it is searching for executables on the server. It appears it is writing information to the registry as well as files in the ktemp directory. I would really like to view the script, however.

    I tried the option to go to the agent procedure history, put my cursor over the section where it shows the audit procedure as scheduled, hold left ALT and click but that doesn't do anything other than to highlight the text in that box. So, at this point I have no idea what sorts of things the latest audit is doing from the script side. I can only watch passively.

    Any ideas?

    Legacy Forum Name: Scripts Forum,
    Legacy Posted By Username: buymeagoat