Auditing Becomes Disabled Following a Backup
Using XIR2 SP4, when a backup runs overnight this sometimes has the effect of disabling auditing on some servers. Auditing is, by default, comprehensively enabled across all servers but we've been checking this over several days and have seen many instances where the auditing was disabled when the servers are re-started after the backup runs and must be manually re-enabled through the CMC.
Has anyone else had a similar experience or could you suggest why this may be happening or how it might be prevented?
I'd also like a quick way of identifying this when it happens - e.g. through a report with alerters to show when the server auditing is disabled (if possible). Does anyone know where the server auditing information is held?