Do a caf status rchost is it enabled? If no then something performed a caf disable rchost
If it is enabled lock at the trc_rchost.log file. The last thing the agent did is at the end of the file.
There is also a cafcmd.log (not exact name) it will show the caf stop rchost command. This will tell you when it was disabled if it was manually disabled or disabled by a script or other application.
Also in the logs directory is there a crash log for rchost. If the process crashed there will be a log.
Sent from my Verizon, Samsung Galaxy smartphone