| Previous | Next |
| ERROR_EVT_VERSION_TOO_NEW | ERROR_EVT_PUBLISHER_DISABLED |
ERROR_EVT_CANNOT_OPEN_CHANNEL_OF_QUERY
A source channel in the multi-channel query is inaccessible
A QueryList can select and suppress events from several channels. Opening the query therefore involves a separate access attempt for each Path. One channel can fail because it is absent, disabled in an incompatible way, remote-only, or denied to the caller while the other sources are valid.
When tolerant query errors are enabled, call EvtGetQueryInfo to obtain the channel-path array and matching status-code array; the index in this error identifies the failing source. Test that channel alone using the same session and security context. Do not assume a syntax error when the QueryList parses successfully but one source cannot be opened.
What to inspect
- Map the reported query index to its Path entry.
- Inspect EvtGetQueryInfo names and per-source status codes.
- Test access to the failing channel with the same local or remote credentials.
References
- Microsoft: structured Event Log query schema
- Microsoft: EvtGetQueryInfo
- Microsoft: querying Windows events
- Microsoft: EvtOpenChannelConfig
Looking for a different code? Search another status or error code.