| Previous | Next |
| ERROR_EVT_CONFIGURATION_ERROR | ERROR_EVT_QUERY_RESULT_INVALID_POSITION |
ERROR_EVT_QUERY_RESULT_STALE
The Event Log query result became stale after log mutation
An Event Log query result is not a frozen snapshot. While it is being enumerated, matching events can be added, and the underlying channel can roll over or be cleared. If records that anchor the result set disappear, the service can no longer preserve the cursor mapping and marks the query handle stale.
Close the result-set handle and issue a new query; repeated EvtNext calls on the same handle will not repair it. Determine whether retention rollover, an explicit clear, enabling an Analytic or Debug channel, or log replacement occurred. For long-running consumers, persist bookmarks and define how to recover when the bookmarked record has already aged out instead of assuming an indefinitely stable cursor.
What to inspect
- Recreate the query handle rather than seeking within the stale result.
- Check channel clear time, oldest record and retention policy.
- Use bookmarks with an explicit missing-record recovery policy.
References
- Microsoft: Event Log XPath subset and result behavior
- Microsoft: EvtNext
- Microsoft: EvtSeek
- MS-EVEN6: Event Log channels
Looking for a different code? Search another status or error code.