feat(kb): Add Change Tracker KB articles — batch 2a

docs/kb/changetracker/troubleshooting-and-errors/agenttaskrunner-processtracker-error.md

@@ -0,0 +1,62 @@
+---
+description: >-
+  This article explains how to resolve the "AgentTaskRunner - task execution
+  failed for task 11 - TrackerPollTask-Baseline-processtracker-88" error in
+  the Rolling Log by adjusting the policy template in Netwrix Change
+  Tracker.
+keywords:
+  - rolling log
+  - AgentTaskRunner
+  - TrackerPollTask
+  - processtracker
+  - Netwrix Change Tracker
+  - policy template
+  - process tracker
+  - agent error
+  - task execution failed
+  - data collector
+  - baseline
+  - troubleshooting
+knowledge_article_id: ka04u000000Hd9iAAC
+products:
+  - change-tracker
+sidebar_label: AgentTaskRunner ProcessTracker Error
+tags: [kb, troubleshooting-and-errors]
+title: >-
+  Rolling-Log Fix: "AgentTaskRunner - Task Execution Failed for Task 11 -
+  TrackerPollTask-Baseline-processtracker-88"
+---
+
+This article explains how to clear the following error from the Rolling Log in Netwrix Change Tracker.
+
+## Symptom
+
+The following error appears in the agent Rolling Log:
+
+```text
+2018-04-10 10:56:26,887 [7] ERROR AgentTaskRunner - task execution failed for task 11 - TrackerPollTask-Baseline-processtracker-88
+NNT.Agent.Tracking.TrackerException: no data collector registered for: processtracker-local
+      at NNT.Agent.Core.Tracking.TrackerBase.GetDataCollector (System.String collectorName, System.Boolean throwException) [0x0002e] in :0
+      at NNT.Agent.Core.Tracking.TrackerBase.PollInternal (NNT.Agent.Core.Tracking.PollControl pollControl, NNT.Agent.Core.Interfaces.IDevice device, NNT.Agent.Core.Interfaces.ITrackerConfiguration
+            configuration, NNT.Agent.Core.Interfaces.IItemStoragePipeline queue, NNT.Agent.Core.Tracking.PollType pollType, System.DateTime pollStartTimeUtc) [0x0004c] in:0
+      at NNT.Agent.Core.Tracking.TrackerBase.Poll (NNT.Agent.Core.Tracking.PollControl pollControl, NNT.Agent.Core.Interfaces.IDevice device, NNT.Agent.Core.Interfaces.IItemStoragePipeline queue,
+            NNT.Agent.Core.Tracking.PollType pollType, System.DateTime pollStartTimeUtc) [0x00075] in :0
+      at NNT.Agent.Core.Tasks.TrackerPollTask.Execute (NNT.Agent.Core.Queue.AgentTaskQueue queueContext) [0x00279] in :0
+      at NNT.Agent.Core.Application.AgentTaskRunner.ExecuteTask (System.Int32 runnerId, NNT.Agent.Core.Interfaces.IAgentTask task, System.DateTime nowUtc, NNT.Agent.Core.Queue.AgentTaskQueue queue)
+            [0x00050] in :0
+```
+
+## Cause
+
+This error occurs because the process tracker in Netwrix Change Tracker is enabled in the policy template, but no specific processes are configured for tracking. The agent cannot execute the tracker poll task without at least one process defined.
+
+## Resolution
+
+Edit the policy template assigned to the affected device and either add processes to track or disable the process tracker.
+
+1. Log into Netwrix Change Tracker and navigate to **Devices** > select the device experiencing the error > select the policy template that is causing the issue.
+2. Either uncheck the **Track processes and services in this template** box, or add at least one service to be tracked.
+
+<!-- Image removed: Screenshot showing the process tracker configuration with the "Track processes and services in this template" checkbox -->
+
+<!-- Image removed: Screenshot showing an example of services added to the process tracker configuration -->

docs/kb/changetracker/troubleshooting-and-errors/deviceconfigtask-wildcards-pathmatch-error.md

@@ -0,0 +1,60 @@
+---
+description: >-
+  Explains the cause and resolution for a Rolling-Log error where
+  AgentTaskRunner fails due to a mismatched path-match type in a policy
+  template in Netwrix Change Tracker.
+keywords:
+  - AgentTaskRunner
+  - DeviceConfigTask
+  - ContainerItemMatchException
+  - path match
+  - wildcards
+  - regex
+  - policy template
+  - rolling log
+  - Netwrix Change Tracker
+  - agent error
+  - custom path match
+  - troubleshooting
+knowledge_article_id: ka0Qk000000DmYHIA0
+products:
+  - change-tracker
+sidebar_label: DeviceConfigTask Wildcards PathMatch Error
+tags: [kb, troubleshooting-and-errors]
+title: >-
+  Rolling-Log Fix: "ERROR AgentTaskRunner - Task Execution Failed for Task -
+  DeviceConfigTask. Item Wildcards Match Text Must Not Contain Separator"
+---
+
+This article explains how to resolve a Rolling-Log error caused by a misconfigured custom path-match definition in a Netwrix Change Tracker policy template.
+
+## Symptom
+
+The following error appears in the agent Rolling Log:
+
+```text
+2018-08-25 12:04:35,780 [9] ERROR AgentTaskRunner - task execution failed for task 2 - DeviceConfigTask-1869
+NNT.Agent.Utils.ContainerItemMatch+ContainerItemMatchException: item wildcards match text must not contain separator '\' for MatchType.Wildcards unless ContainerMatchAppliesToWholePath is true.
+   at NNT.Agent.Utils.ContainerItemMatch.ValidateMatchPattern(String element, String matchPattern, MatchType matchType, String separator, Boolean containerMatchAppliesToWholePath)
+   at NNT.Agent.Utils.ContainerItemMatch..ctor(String rootContainer, Boolean skipRootContainer, String separator, Boolean caseSensitive, Nullable`1 recursionLevels, MatchType containerMatchType, String containerMatchPattern, Boolean containerMatchAppliesToWholePath, MatchType itemMatchType, String itemMatchPattern)
+   at NNT.Agent.Core.Tracking.FileSystem.FileSystemTrackerConfigurationCreator.ProcessDeviceConfiguration(DeviceConfiguration deviceConfiguration, IDevice device, String trackerName)
+   at NNT.Agent.Core.Tasks.DeviceConfigTask.ApplyDeviceConfigAction(ILifetimeScope scope, IDevice device, DeviceConfiguration configuration, Nullable`1 latestConfigDateUtc)
+   at NNT.Agent.Core.Tasks.DeviceConfigTask.Execute(AgentTaskQueue queueContext)
+   at NNT.Agent.Core.Application.AgentTaskRunner.ExecuteTask(Int32 runnerId, IAgentTask task, DateTime nowUtc, AgentTaskQueue queue)
+```
+
+## Cause
+
+The agent cannot process an item within the advanced custom path-match definition because the match type is set to **Wildcards** but the match pattern contains regex syntax (or vice versa).
+
+<!-- Image removed: Screenshot showing a custom path-match definition with regex code but the match type incorrectly set to Wildcards -->
+
+## Resolution
+
+If you are receiving this error, the agent may not be reporting to your hub. This is a critical error and monitoring will not continue until it is resolved.
+
+1. Log into the **Netwrix Change Tracker console**.
+2. Locate the agent presenting this error and go into each of the policy templates assigned to that agent. Inspect the custom path matches for misconfiguration.
+3. Once you have identified the problem template, modify or remove the custom path-match definition that is causing the issue. For example, change the match type from **Wildcards** to **Regex** if the pattern contains regex syntax.
+4. Save the policy template.
+5. Check the agent to confirm it has received the new configuration.

docs/kb/changetracker/troubleshooting-and-errors/duplicate-events-in-syslogs.md

@@ -0,0 +1,65 @@
+---
+description: >-
+  Explains why old or duplicate events appear as new in syslogs and shows how
+  to remove pending notifications from MongoDB to prevent re-reporting of
+  outdated events in Netwrix Change Tracker.
+keywords:
+  - syslogs
+  - duplicate events
+  - MongoDB
+  - NotificationQueue
+  - PendingNotifications
+  - NNTHubService
+  - MongoDB Shell
+  - Netwrix Change Tracker
+  - old events
+  - IncomingEventQueue
+  - BackgroundTaskQueue
+  - troubleshooting
+knowledge_article_id: ka0Qk0000001R2zIAE
+products:
+  - change-tracker
+sidebar_label: Duplicate Events in Syslogs
+tags: [kb, troubleshooting-and-errors]
+title: Old or Duplicate Events Reported as New in Syslogs
+---
+
+This article explains why old or duplicate events may appear as new in syslogs and how to resolve the issue by clearing the pending notifications queue in MongoDB.
+
+## Symptom
+
+- Old events appear in syslogs as new events. Upon further investigation, these are confirmed to be duplicates of previously reported events.
+- The affected events have not been resubmitted.
+
+## Cause
+
+The pending notifications queue in the MongoDB database contains notifications for older events. When the outdated notifications are released, they are reported as new events or duplicates of previously reported events.
+
+## Resolution
+
+1. Download the MongoDB Shell `.zip` from the [MongoDB Shell download page](https://www.mongodb.com/try/download/shell) and place the contents into `C:\Program Files\NNT Change Tracker Suite\Gen7\MongoDB\bin`.
+
+2. Once copied, run the `mongosh.exe` application to connect to your MongoDB database. Run the following command:
+
+   ```text
+   mongodb://localhost:27017
+   ```
+
+   > **NOTE:** Replace `27017` with the correct port if MongoDB in your environment uses a different port.
+
+3. Once connected to your MongoDB database, run the following commands to confirm whether notifications are queued:
+
+   ```text
+   use NNTHubService
+   db.IncomingEventQueue.countDocuments()
+   db.NotificationQueue.countDocuments()
+   db.PendingNotifications.countDocuments()
+   db.BackgroundTaskQueue.countDocuments()
+   ```
+
+4. To clean up the queued notifications, run the following commands:
+
+   ```text
+   use NNTHubService
+   db.NotificationQueue.deleteMany({})
+   ```

docs/kb/changetracker/troubleshooting-and-errors/file-entry-not-found-error.md

@@ -0,0 +1,57 @@
+---
+description: >-
+  Explains the "FileContentTrackerDataCollectorLocal - couldn't locate File
+  entry" rolling-log message in Netwrix Change Tracker, when it is safe to
+  ignore, and how to troubleshoot if the file should exist.
+keywords:
+  - FileContentTrackerDataCollectorLocal
+  - rolling log
+  - file tracking
+  - file not found
+  - Netwrix Change Tracker
+  - agent
+  - policy template
+  - content tracking
+  - yum.conf
+  - troubleshooting
+  - file entry
+  - permissions
+knowledge_article_id: ka04u000000Hd9NAAS
+products:
+  - change-tracker
+sidebar_label: File Entry Not Found Error
+tags: [kb, troubleshooting-and-errors]
+title: >-
+  Rolling-Log Fix: "FileContentTrackerDataCollectorLocal - Couldn't Locate
+  File Entry for /mydirectory/my.file"
+---
+
+This article explains the `FileContentTrackerDataCollectorLocal - couldn't locate File entry` message in the Netwrix Change Tracker agent Rolling Log and when it is safe to ignore.
+
+## Symptom
+
+The following error appears in the agent Rolling Log:
+
+```text
+2017-10-02 07:42:42,082 [5] ERROR FileContentTrackerDataCollectorLocal - couldn't locate File entry for /etc/yum.conf
+```
+
+## Cause
+
+This error occurs when a policy template in Netwrix Change Tracker is set to track file contents for a specific file, but the agent cannot locate that file on the monitored device.
+
+## Resolution
+
+### If the file does not exist on the device
+
+If you are receiving this error for a file that does not exist on the device, it is safe to ignore. If you are using one template to track multiple agents and some agents have the file while others do not, it is not a problem to let the template continue tracking this file.
+
+> **NOTE:** The only caution is the number of files the template is looking for. If the template grows significantly, having a large volume of these errors may cause performance issues. However, in most cases, it is perfectly fine.
+
+### If the file should exist
+
+If the file exists but the error still appears, verify the following:
+
+1. Verify the policy template is looking for the file in the correct location.
+2. If the file is stored in different locations on different servers, define all potential locations in the template.
+3. Check whether the file has special permissions that prevent the agent from reading it. If so, adjust the file permissions or the privileges of the account the agent uses.

docs/kb/changetracker/troubleshooting-and-errors/filehash-sha256-file-not-found-error.md

@@ -0,0 +1,57 @@
+---
+description: >-
+  Explains the Rolling-Log error where ItemStoragePipeline cannot collect a
+  file's SHA256 hash because the file is missing, and provides guidance and
+  troubleshooting steps for Netwrix Change Tracker.
+keywords:
+  - ItemStoragePipeline
+  - file hash
+  - SHA256
+  - file not found
+  - rolling log
+  - Netwrix Change Tracker
+  - agent
+  - policy template
+  - file tracking
+  - troubleshooting
+  - error processing item
+  - permissions
+knowledge_article_id: ka04u000000Hd9mAAC
+products:
+  - change-tracker
+sidebar_label: FileHash SHA256 File Not Found Error
+tags: [kb, troubleshooting-and-errors]
+title: >-
+  Rolling-Log Fix: "ItemStoragePipeline - Error Processing Item, Couldn't
+  Collect FileHashSHA256 for File - Could Not Find File"
+---
+
+This article explains the `ItemStoragePipeline - Error processing item, couldn't collect filehashsha256` error in the Netwrix Change Tracker agent Rolling Log and when it is safe to ignore.
+
+## Symptom
+
+The following error appears in the agent Rolling Log:
+
+```text
+2017-10-11 08:11:18,385 [4] ERROR ItemStoragePipeline - Error processing item, couldn't collect filehashsha256 for file: /etc/rc6.d/K05dsmcad Error: Failed to collect data for attribute (Could not find file "/etc/rc6.d/K05dsmcad")
+```
+
+## Cause
+
+This error occurs when a policy template in Netwrix Change Tracker is set to track a file and the agent cannot compute the SHA256 hash because the file is not found on the monitored device.
+
+## Resolution
+
+### If the file does not exist on the device
+
+If you are receiving this error for a file that does not exist on the device, it is safe to ignore. If you are using one template to track multiple agents and some agents have the file while others do not, it is not a problem to let the template continue tracking this file.
+
+> **NOTE:** The only caution is the number of files the template is looking for. If the template grows significantly, having a large volume of these errors may cause performance issues. However, in most cases, it is perfectly fine.
+
+### If the file should exist
+
+If the file exists but the error still appears, verify the following:
+
+1. Verify the policy template is looking for the file in the correct location.
+2. If the file is stored in different locations on different servers, define all potential locations in the template.
+3. Check whether the file has special permissions that prevent the agent from reading it. If so, adjust the file permissions or the privileges of the account the agent uses.

docs/kb/changetracker/troubleshooting-and-errors/hub-offline-connection-retries-exhausted.md

@@ -0,0 +1,66 @@
+---
+description: >-
+  Explains the "Hub Offline, connection retries exhausted" rolling-log error
+  for Netwrix Change Tracker agents and how to troubleshoot connectivity
+  between the agent and the Netwrix Server.
+keywords:
+  - Hub Offline
+  - connection retries exhausted
+  - agent connectivity
+  - Netwrix Server
+  - firewall
+  - DNS
+  - NAT
+  - port forwarding
+  - rolling log
+  - Netwrix Change Tracker
+  - remote server
+  - troubleshooting
+knowledge_article_id: ka0Qk000000DldpIAC
+products:
+  - change-tracker
+sidebar_label: Hub Offline Connection Retries Exhausted
+tags: [kb, troubleshooting-and-errors]
+title: >-
+  Rolling-Log Fix: "Hub Offline, Connection Retries Exhausted - Unable to
+  Connect to the Remote Server"
+---
+
+This article explains how to troubleshoot the `Hub Offline, connection retries exhausted` error in the Netwrix Change Tracker agent Rolling Log.
+
+## Symptom
+
+The following error appears in the agent Rolling Log:
+
+```text
+2017-11-25 09:22:56,446 [10] INFO  Message - Hub Offline, connection retries exhausted. Sleeping until 11/25/2017 2:24:31 PM (Unable to connect to the remote server - No connection could be made because the target machine actively refused it 192.168.1.1:443)
+```
+
+## Cause
+
+This error occurs when the agent cannot reach the Netwrix Server. Common causes include:
+
+- The Netwrix Server may be powered off, IIS is not running, or MongoDB is not running.
+- The Netwrix Server may not be on the domain, does not have a network connection, or is in the wrong subnet.
+- The port the agent is using is currently being used by another application, causing a conflict.
+- A firewall is blocking the connection to the Netwrix Server over the specified port.
+- Network routes are not configured to allow communication between the Netwrix Server and the agent.
+- If the agent was configured using an FQDN instead of an IP address, the issue could be DNS-related.
+- If the agent is on a cloud provider network, the cloud provider's traffic rules may need to be modified to allow communication.
+- If the agent is on a WAN or a different LAN:
+    - Port forwarding may need to be configured.
+    - NAT settings may need to be modified to allow communication.
+    - Proxy settings may need to be modified if a web or other proxy is in use.
+
+## Resolution
+
+If you are receiving this error, the agent is currently not sending any logs to the Netwrix Server. Verify the following common causes:
+
+- **Confirm the Netwrix Server is running.** Verify that IIS and MongoDB services are running on the Netwrix Change Tracker Hub server.
+- **Test connectivity from the agent host.** From the agent, attempt to reach the Hub URL (for example, using `ping`, `curl`, or `Test-NetConnection`). If the Hub URL uses an FQDN, confirm the agent can resolve it via DNS.
+- **Verify firewall and port configuration.** Confirm the port defined in the agent's `HubDetails.xml` (typically 443) is open between the agent and the Netwrix Server. See [Network Ports for Change Tracker](/docs/kb/changetracker/configuration-and-setup/network-ports-for-change-tracker) or the [Agent and Device Ports](/docs/changetracker/8_2/requirements/agentdeviceports) product doc.
+
+After correcting the underlying issue, restart the agent service to force a reconnection.
+
+<!-- SME REVIEW NEEDED: Please confirm the troubleshooting steps above and expand with any product-specific commands, additional guidance, or missing scenarios (e.g., WAN/LAN-specific steps). -->
+