| Previous | Next |
| ERROR_EVT_MAX_INSERTS_REACHED | ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND |
ERROR_EVT_EVENT_DEFINITION_NOT_FOUND
No manifest event definition matches this event identifier
A provider manifest defines each event by an ID and version together with its channel, level, task, opcode, keywords, message and optional data template. Consumers enumerate those definitions from publisher metadata. If a recorded event refers to an ID or version absent from the available metadata, Event Log cannot map it to the expected definition.
Record the provider GUID or name, event ID and event version from the raw event XML. Compare them with metadata from EvtOpenEventMetadataEnum. Old EVTX files often outlive the provider version that created them, while partial upgrades can leave new event records with old resources. Use the correct provider package or archived metadata rather than assigning a similar event definition by guesswork.
What to inspect
- Read provider, event ID and version from raw event XML.
- Enumerate the installed provider event definitions.
- Use matching archived or installed metadata for historical logs.
References
- Microsoft: enumerating provider event definitions
- Microsoft: reading event-definition metadata
- Microsoft: defining manifest-based events
- Microsoft: archiving localized event resources
Looking for a different code? Search another status or error code.