What does Windows error code 15085 (ERROR_EC_NO_ACTIVE_CHANNEL) mean?

ERROR_EC_NO_ACTIVE_CHANNEL

ERROR_EC_NO_ACTIVE_CHANNEL means that the subscription query did not resolve to an active source event channel. The query can be syntactically valid and still fail when every referenced channel is unavailable or disabled on the relevant source computers. This differs from a disabled collector destination log: here the problem is the set of channels from which the subscription is meant to select events.

Validate the query where it runs

• Inspect the stored Query with wecutil gs <subscription-id> /f:XML. In the subscription model, that query determines which events an event source selects before forwarding.
• On a representative source computer, list channels with wevtutil el and inspect the exact channel named in each Query Path.
• Check the channel's enabled state and confirm that the Windows edition, installed role, and event provider actually expose it. Operational channels commonly vary between device roles and installed components.
• Enable a required source channel only when it is intentionally part of the monitoring design. Enabling ForwardedEvents fixes a collector destination problem, not a missing source channel.

Use a minimal selector to isolate topology

Temporarily test one known-present source channel and a simple selection before restoring a broad multi-channel query. That separates absent or disabled channels from later failures involving XPath semantics, remote authorization, delivery mode, or destination-log configuration.

References

• Microsoft: WEC query and source-selection properties
• Microsoft: Wevtutil channel enumeration and configuration
• NXLog: WEF query configuration and source-channel examples

Looking for a different code? Search another status or error code.