What does Windows error code 15080 (ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE) mean?

ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE

ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE is raised while Windows Event Collector tries to bring an event-forwarding subscription online. Activation evaluates the saved subscription as a whole: whether it is enabled, the event query, destination log, delivery settings, transport, and the subscription model. It is therefore broader than a failed connection to one particular event source.

Identify the failing layer before changing the design

• Use wecutil gs <subscription-id> /f:XML to inspect the stored Enabled, Query, LogFile, delivery, and transport settings.
• Use wecutil gr <subscription-id> to inspect runtime state and the last error. For collector-initiated subscriptions, also inspect each named event source.
• Confirm that the Windows Event Collector service is running. wecutil qc /q configures the service and enables the default ForwardedEvents channel, but it does not validate a custom destination log or a remote source.

Keep configuration and delivery failures separate

In a source-initiated design, clients discover the Subscription Manager through policy and then push matching events to the collector. In a collector-initiated design, the collector contains the list of sources and opens connections to them. A malformed query, disabled destination log, or invalid subscription property can prevent activation before a source is useful for diagnosis; a per-source authentication or reachability problem is best read from subscription runtime status.

References

• Microsoft: Windows Event Collector architecture
• Microsoft: Wecutil commands and subscription runtime status
• NXLog: Windows Event Forwarding roles and subscription models

Looking for a different code? Search another status or error code.