E.4. Troubleshooting the Audit Player

This section provides help on solving common problems of the Audit Player application (AP).

Keys and certificates

The Audit Player application requires encryption keys and certificates to use its various features. The following summarizes where the keys and certificates should be stored on Windows for AP to function properly. For details on these certificates, see Procedure E.3.3.1, Certificates and Audit Player.

Keyframe building errors

When loading audit trails containing a very large number of objects (typically, audit trails of X11 traffic), the Audit Player application might stop processing the audit trail and terminate. This is caused by reaching the GDI Object Handle Limit, which is 10000 by default.

To overcome this problem, increase the value of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota registry key (up to the maximum of 65535) and reboot the computer.