detection.wiki

Microsoft-Windows-EventCollector

9 events across 1 channel

Event IDTitleChannel
1The Subscription SubscriptionId could not be activated on target machine …Operational
2The Subscription SubscriptionId could not be activated on machine MachineName …Operational
3The Subscription SubscriptionId has expired and will no longer be serviced.Operational
4The Subscription SubscriptionId could not be activated on target machine …Operational
5The Subscription SubscriptionId was activated successfully on target machine …Operational
6The Subscription SubscriptionId could not publisher events from target machine …Operational
9The Subscription SubscriptionId could not be activated on target machine …Operational
501The Subscription SubscriptionId has a lost event.Operational
502The Subscription SubscriptionId detects dropped events.Operational

Event ID 1 — The Subscription SubscriptionId could not be activated on target machine MachineName due to communication error.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Message #

The Subscription %1 could not be activated on target machine %2 due to communication error.  Error Code is %3.  All retries have been performed before reaching this point and so the subscription will remain inactive on this target until subscription is resubmitted / reset. Additional fault message:%4

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
ErrorCode UInt32—
FaultMessage UnicodeString—

Event ID 2 — The Subscription SubscriptionId could not be activated on machine MachineName due to an error.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Description

The Subscription SubscriptionId could not be activated on machine MachineName due to an error. Error Code is ErrorCode. Subscription will remain inactive on this target until subscription is resubmitted / reset.

Message #

The Subscription %1 could not be activated on machine %2 due to an error. Error Code is %3. Subscription will remain inactive on this target until subscription is resubmitted / reset.

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
ErrorCode UInt32—

Event ID 3 — The Subscription SubscriptionId has expired and will no longer be serviced.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Description

The Subscription SubscriptionId has expired and will no longer be serviced.

Message #

The Subscription %1 has expired and will no longer be serviced.

Fields #

NameDescription
SubscriptionId UnicodeString—

Event ID 4 — The Subscription SubscriptionId could not be activated on target machine MachineName due to communication error.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Message #

The Subscription %1 could not be activated on target machine %2 due to communication error.  Error Code is %3.  The subscription will be in retrying state until the subscription becomes active or all retries have been performed. Additional fault message:%4

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
ErrorCode UInt32—
FaultMessage UnicodeString—

Event ID 5 — The Subscription SubscriptionId was activated successfully on target machine MachineName.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Description

The Subscription SubscriptionId was activated successfully on target machine MachineName.

Message #

The Subscription %1 was activated successfully on target machine %2.

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—

Event ID 6 — The Subscription SubscriptionId could not publisher events from target machine MachineName to the log file of this subscription.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Message #

The Subscription %1 could not publisher events from target machine %2 to the log file of this subscription.  Error Code is %3.  All retries have been performed before reaching this point and so the subscription will remain inactive on this target until subscription is resubmitted / reset.

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
ErrorCode UInt32—

Event ID 9 — The Subscription SubscriptionId could not be activated on target machine MachineName due to communication error.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Description

The Subscription SubscriptionId could not be activated on target machine MachineName due to communication error. Error Code is ErrorCode. The EventSource is removed from the subscription. reason: reason.

Message #

The Subscription %1 could not be activated on target machine %2 due to communication error.  Error Code is %3. The EventSource is removed from the subscription. reason: %4

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
ErrorCode UInt32—
reason UnicodeString—

Event ID 501 — The Subscription SubscriptionId has a lost event.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Description

The Subscription SubscriptionId has a lost event. An event from target machine MachineName is lost and could not be delivered. Error Code is ErrorCode. Event data is:EventData.

Message #

The Subscription %1 has a lost event. An event from target machine %2 is lost and could not be delivered. Error Code is %3. Event data is:%4

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
ErrorCode UInt32—
EventData UnicodeString—

Event ID 502 — The Subscription SubscriptionId detects dropped events.

Provider
Microsoft-Windows-EventCollector
Channel
Operational

Description

The Subscription SubscriptionId detects dropped events. Some events are dropped during transmission from target machine MachineName. The number of dropped events are EventCount.

Message #

The Subscription %1 detects dropped events. Some events are dropped during transmission from target machine %2. The number of dropped events are %3.

Fields #

NameDescription
SubscriptionId UnicodeString—
MachineName UnicodeString—
EventCount UInt32—