What does Windows error code 15081 (ERROR_EC_LOG_DISABLED) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The subscription destination log is disabled.

Previous	Next
ERROR_EC_SUBSCRIPTION_CANNOT_ACTIVATE	ERROR_EC_CIRCULAR_FORWARDING

ERROR_EC_LOG_DISABLED

ERROR_EC_LOG_DISABLED refers to the local event log selected by the subscription's LogFile setting. That log is the collector-side destination for received events; it is not necessarily one of the source channels named in the query. A valid query can therefore still fail to activate when the destination channel has been disabled.

Check the destination, not only the selector

Run wecutil gs <subscription-id> /f:XML and record the exact LogFile value.
On the collector, verify that this event log is enabled and writable by the Event Log service. For the usual destination, that value is ForwardedEvents; a subscription can instead name a custom collector log.
For the default destination, wecutil qc /q is designed to enable ForwardedEvents and configure the collector service. For a custom destination, correct that channel's configuration rather than assuming quick-config repairs it.
Recheck wecutil gr <subscription-id> after enabling the intended destination.

What this code does not establish

It does not prove that the source event channel is disabled, that the source can authenticate, or that the XPath-like event selector is valid. Those are separate checks. The subscription query selects events on the source; the LogFile property determines where the collector stores the events that arrive.

References

Looking for a different code? Search another status or error code.