What does Windows error code 15083 (ERROR_EC_CREDSTORE_FULL) mean?

ERROR_EC_CREDSTORE_FULL

ERROR_EC_CREDSTORE_FULL concerns credentials retained by Windows Event Collector for subscription access to event sources. In a collector-initiated subscription, credentials can be assigned to an individual source or shared across sources. This is not the size limit of the ForwardedEvents log and is not cured by clearing collected events.

Audit the stored relationships first

• List subscriptions with wecutil es, then inspect each relevant configuration with wecutil gs <subscription-id> /f:XML.
• Identify collector-initiated subscriptions with obsolete source hosts or per-host credentials. The EventSources list and shared-credential settings are the relevant configuration, not the event data already stored in the destination log.
• Remove an obsolete source only from the subscription that owns it, for example with the documented wecutil ss source-removal option, or retire an unused subscription through the normal change process.
• Where a source-initiated design is appropriate, do not create a distinct stored credential for every client merely to mimic a collector-initiated source list. Source-initiated subscriptions are designed to accept configured forwarders without enumerating every source in the subscription.

Do not erase diagnostic evidence

Changing the size or retention of the destination log addresses event storage, not credential capacity. Capture the subscription XML and runtime status before deleting a subscription, because that information identifies which sources and authentication model must be restored.

References

• Microsoft: per-source and shared WEC credentials
• Microsoft: collector-initiated subscriptions and event-source configuration
• NXLog: push and pull Event Forwarding topologies

Looking for a different code? Search another status or error code.