| Previous | Next |
| ERROR_EC_LOG_DISABLED | ERROR_EC_CREDSTORE_FULL |
ERROR_EC_CIRCULAR_FORWARDING
ERROR_EC_CIRCULAR_FORWARDING is a guard against a self-feeding Windows Event Forwarding subscription. It occurs when the local computer is both source and collector, and the subscription query includes the same destination log into which that subscription writes. Without the guard, a newly received event could match the same query again and be forwarded repeatedly.
Recognize the loop
| Subscription element | Problematic relationship |
|---|---|
LogFile | The collector stores received events in this local log. |
Query | The local-source portion of the query selects that same log. |
| Local source | The collector itself is included as an event source or is configured to forward to itself. |
Correct the data flow
- Do not make one subscription select from its own destination log. If the collector output must be exported again, use a separate downstream reader or agent rather than another self-referential WEC subscription.
- For a local test, select an original producer channel such as
Applicationand store received events in a different destination log. - Review the source list for collector-initiated subscriptions and the Subscription Manager policy for source-initiated subscriptions. A local machine can be included unintentionally during broad deployment.
This is distinct from a disabled destination log: enabling the channel does not make a circular topology safe. The fix is to remove the feedback path from the subscription definition.
References
- Microsoft: Event Collector architecture and destination-log behavior
- Microsoft: collector-initiated subscriptions, query and destination log properties
- NXLog: WEF roles and separating collection from downstream processing
Looking for a different code? Search another status or error code.