Why are there no APP_START events in the RootCause Log for System Services?
Unlike all other processes, you will _not_ see an APP_START event in the RootCause log when a System Service starts. So, if you want to trace a System Service, you must manually Register it (either with the “rootcause new” command or the RootCause GUI’s Workspace->New dialog), and thereafter you will see APP_TRACED events for it in the RootCause log.