| Event Id | 6 |
| Source | Microsoft-Windows-EventCollector |
| Description | The Subscription %1 could not publish events from target machine %2 to the log file of this subscription. Error Code is %3. All retries have been performed before reaching this point and so the subscription will remain inactive on this target until subscription is resubmitted / reset. |
| Event Information | According to Microsoft : Cause This event is logged when the Subscription could not publish events from target machine to the log file of this subscription. Diagnose Events could not be published. First, attempt to increase the disk space to fix the problem, and if event 6 appears in the System log after disk space has been increased, try to resolve Event Log service errors to fix the problem. Resolution To resolve this issue, use the resolution that corresponds to the cause you identified in the Diagnose section. After performing the resolution, see the Verify section to confirm that the feature is operating properly Cause 1.Event Log Service Problem 2.Low Free Space on System Volume Resolution 1.Fix Event Log service errors 2.Increase the disk space Fix Event Log service errors Event 6 can indicate that there is a problem with the Event Log service. To fix the problems with the Event Log service, the Event Log service errors must be resolved. For general troubleshooting information about the Event Log service that should help resolve the problem Increase the disk space Events could not be delivered to the Event Log service. Normally, when this is the case, the system stores the undelivered events in a buffer, and the events are later delivered when the Event Log service becomes available. The events are saved into a file on the local hard disk. Lack of space on the hard disk may prevent this from happening. Check the amount of free space on the hard disk and try to increase this amount by deleting files. To check the free disk space available on the local hard disk: 1.Click the Start button. 2.Click Computer. 3.Click the drive that represents the local hard disk.After the drive is selected, the Details pane will show the free space on the drive. Verify Restart the local computer and then use the Event Viewer to read the System event log. Verify that there are no new events with an event identifier equal to 6 or 501 that were logged after the computer was restarted |
| Reference Links | Event ID 6 from Microsoft-Windows-EventCollector |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.