| Previous | Next |
| ERROR_EC_CRED_NOT_FOUND | ERROR_MUI_FILE_NOT_FOUND |
ERROR_EC_NO_ACTIVE_CHANNEL
ERROR_EC_NO_ACTIVE_CHANNEL means that the subscription query did not resolve to an active source event channel. The query can be syntactically valid and still fail when every referenced channel is unavailable or disabled on the relevant source computers. This differs from a disabled collector destination log: here the problem is the set of channels from which the subscription is meant to select events.
Validate the query where it runs
- Inspect the stored
Querywithwecutil gs <subscription-id> /f:XML. In the subscription model, that query determines which events an event source selects before forwarding. - On a representative source computer, list channels with
wevtutil eland inspect the exact channel named in eachQuery Path. - Check the channel's enabled state and confirm that the Windows edition, installed role, and event provider actually expose it. Operational channels commonly vary between device roles and installed components.
- Enable a required source channel only when it is intentionally part of the monitoring design. Enabling
ForwardedEventsfixes a collector destination problem, not a missing source channel.
Use a minimal selector to isolate topology
Temporarily test one known-present source channel and a simple selection before restoring a broad multi-channel query. That separates absent or disabled channels from later failures involving XPath semantics, remote authorization, delivery mode, or destination-log configuration.
References
- Microsoft: WEC query and source-selection properties
- Microsoft: Wevtutil channel enumeration and configuration
- NXLog: WEF query configuration and source-channel examples
Looking for a different code? Search another status or error code.