Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running into an issue when trying to use a custom log journal for storing forwarded events (via subscription) on a Windows 2008 R2 server, the custom log being described as not being a "valid destination log".

I'm currently setting up an architecture for centralizing Windows events using the built-in event forwarding and collection capabilities (via WS-management and wecutil).

One of my requirements is to be able to create several subscriptions on the collector machine and to store forwarded events in different log files. For that, I tested creating a custom log (called CustomLog). This log appears in the Event Viewer, under the "Applications and Services Logs" category.

However, I am not able to redirect forwarded events to this CustomLog. CustomLog does not appear in the list of possible destination when creating a subscription in the Event Viewer user interface.

To try what could be wrong, I left it with the default ForwardedEvents as destination and I tried to change it via Powershell. I ran the following command, which is supposed to set the destination log as CustomLog:

wecutil ss "Collect from both sources" /lf:CustomLog

It ran without error. Though, no events are logged into CustomLog, and when I go back to the GUI to create/modify subscriptions and I try to open the subscription I set, I get a pop-up stating the following:

The destination log defined in this subscription cannot be found in the list of valid destination logs on this computer. verify that this log exists on the computer and is valid as a destination for forwarded events. Note that classic logs, analytic and debug logs and the Security log cannot be used as destination.

Does anybody know what a "valid destination log" is and how I could turn my CustomLog into such a valid destination?

share|improve this question

wecutil allows an XML file to be used to provide configuration information. You could try place CustomLog as a target destination.


It contains a sample XML file that you can use

Please look also at

This suggests it may not be possible, but does offer the XML solution as an option, but without any confirmation of success.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.