| Previous | Next |
| ERROR_EVT_MALFORMED_XML_TEXT | ERROR_EVT_CONFIGURATION_ERROR |
ERROR_EVT_SUBSCRIPTION_TO_DIRECT_CHANNEL
Direct channels cannot be consumed through an Event Log subscription
Analytic and Debug channels use direct delivery to their backing log and are intended for high-volume diagnostic events. Windows does not support EvtSubscribe against these direct channels. This is a channel-type restriction, not a transient subscription-service failure and not evidence that the publisher stopped writing events.
Use the workflow documented for Analytic and Debug logs: enable the channel only for the diagnostic interval, reproduce the problem, disable it, and then query the resulting log. Be careful because enabling such a channel clears its existing events, and a circular direct log may need to be disabled before it can be queried reliably. For continuous subscriptions, select an Admin or Operational channel instead.
What to inspect
- Confirm the channel type in its manifest or configuration.
- Do not retry EvtSubscribe against an Analytic or Debug channel.
- Capture the direct log using enable, reproduce, disable and query steps.
References
Looking for a different code? Search another status or error code.