| Previous | Next |
| ERROR_EC_CIRCULAR_FORWARDING | ERROR_EC_CRED_NOT_FOUND |
ERROR_EC_CREDSTORE_FULL
ERROR_EC_CREDSTORE_FULL concerns credentials retained by Windows Event Collector for subscription access to event sources. In a collector-initiated subscription, credentials can be assigned to an individual source or shared across sources. This is not the size limit of the ForwardedEvents log and is not cured by clearing collected events.
Audit the stored relationships first
- List subscriptions with
wecutil es, then inspect each relevant configuration withwecutil gs <subscription-id> /f:XML. - Identify collector-initiated subscriptions with obsolete source hosts or per-host credentials. The
EventSourceslist and shared-credential settings are the relevant configuration, not the event data already stored in the destination log. - Remove an obsolete source only from the subscription that owns it, for example with the documented
wecutil sssource-removal option, or retire an unused subscription through the normal change process. - Where a source-initiated design is appropriate, do not create a distinct stored credential for every client merely to mimic a collector-initiated source list. Source-initiated subscriptions are designed to accept configured forwarders without enumerating every source in the subscription.
Do not erase diagnostic evidence
Changing the size or retention of the destination log addresses event storage, not credential capacity. Capture the subscription XML and runtime status before deleting a subscription, because that information identifies which sources and authentication model must be restored.
References
- Microsoft: per-source and shared WEC credentials
- Microsoft: collector-initiated subscriptions and event-source configuration
- NXLog: push and pull Event Forwarding topologies
Looking for a different code? Search another status or error code.