| Previous | Next |
| UTC_E_FORWARDER_ALREADY_DISABLED | UTC_E_DIAGRULES_SCHEMAVERSION_MISMATCH |
UTC_E_EVENTLOG_ENTRY_MALFORMED
Interpret the result in context: Event Log XML ingestion
UTC_E_EVENTLOG_ENTRY_MALFORMED (0x87C51009) is a Universal Telemetry Client result from the DiagTrack scenario-definition processing layer for this HRESULT. Start by locating the exact scenario-engine boundary that emitted this Value. Here the relevant owner is Event Log XML ingestion: UTC received an event representation that could not be parsed as the expected Windows Event Log XML for this HRESULT. This is narrower than a generic failure of Connected User Experiences and Telemetry for this HRESULT.
Build a minimal evidence set
| UTC diagnostic field | Value |
|---|---|
| Producing layer | DiagTrack scenario-definition processing |
| Owning state or object | Event Log XML ingestion |
| Decisive evidence | raw rendered XML, channel/provider/event ID, rendering API, encoding, truncation point and parser error offset |
| Narrow comparison | export the same event with wevtutil or Get-WinEvent XML rendering and compare it with the supplied payload |
| Do not confuse with | UTC_E_FILTER_INVALID_COMMAND reports a malformed scenario-filter command, not malformed event XML |
The AllStat message names the immediate condition as “Cannot parse EventLog XML: The entry is malformed” for this HRESULT. In practice, the useful extension is to ask whether the request was rejected before any side effect, after partial setup, or during cleanup for this HRESULT. Verify the existence and ownership of the expected output—session, directory, process, result object or emitted event—rather than assuming the message describes the final system state for this HRESULT.
Run an A/B check
- Associate this result with one request, one scenario version and one service process ID for this HRESULT.
- Save raw rendered XML, channel/provider/event ID, rendering API, encoding, truncation point and parser error offset and the first lower-level HRESULT if one exists for this HRESULT.
- Change no policy, provider set or destination except for this test: export the same event with wevtutil or Get-WinEvent XML rendering and compare it with the supplied payload for this HRESULT.
- Compare the produced artifacts and operational events, not only the top-level return Value.
The most informative neighbor is UTC_E_FILTER_INVALID_COMMAND. The distinction is concrete: UTC_E_FILTER_INVALID_COMMAND reports a malformed scenario-filter command, not malformed event XML for this HRESULT. Keeping both symbolic names in logs prevents a broad “DiagTrack error” bucket from hiding whether the failure occurred during parsing, authorization, resource acquisition, execution or teardown for this HRESULT.
Configuration-generation check
Hash the scenario, rules and referenced profile files used for this HRESULT, and record the UTC process start time. If files changed after the process loaded them, restart only after preserving the prior generation so the comparison remains auditable for this HRESULT.
Safe remediation
Preserve valid Event/System structure, correct encoding or truncation, and retest with one event for this HRESULT. Apply that change only to the owning boundary for this HRESULT. A successful repair must make the controlled case cross this boundary while retaining the intended policy, trace providers, destination and security context for this HRESULT.
Restarting Windows, clearing every ETL file or disabling diagnostic policy is not a justified first response to this result. Those actions destroy evidence and can change several independent UTC gates at once for this HRESULT.
- the same request now produces its documented success or nonfatal status without a second hidden retry
- the operational log shows one coherent request lifetime and no orphaned action, timer, process or trace session
- teardown followed by a second run does not reuse stale state or recreate Event Log XML ingestion
- the nearby condition remains distinguishable: UTC_E_FILTER_INVALID_COMMAND reports a malformed scenario-filter command, not malformed event XML
Technical references
- Microsoft Open Specifications: Windows error-code registry — reference for DiagTrack scenario-definition processing while interpreting this result.
- Microsoft: Universal Telemetry Client configuration diagnosis — reference for DiagTrack scenario-definition processing while interpreting this result.
- Microsoft: UniversalTelemetryClient operational-log guidance — reference for DiagTrack scenario-definition processing while interpreting it.
- Microsoft: Windows Event Log query schema
Looking for a different code? Search another status or error code.