I am writing a software program that relies very heavily on event forwarding. It uses a collector-initiated subscription. After the subscription is created it works fine, as expected. Sometime later, could be a week or a month, the subscription will fail. Events will no longer get forwarded. When I run the command "wecutil gr" it gets stuck. If I try to view the subscription through the event viewer, the event viewer will freeze up and I will have to kill the event viewer task to close it. Once I get to this point the event forwarding will not work again. The only way to fix it is to reinstall the Windows Management Framework. I started observing this issue about 3 years ago running Windows 7 Professional.

Below is the configuration:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <Delivery Mode="Pull">
      <Heartbeat Interval="60000" />
                <Query Id="0" Path="SourceLog">
                    <Select Path="SourceLog">*</Select>
  <Locale Language="en-US" />


Any help would be greatly appreciated.


  • How many clients are connected to this collector ? Can you still see the subscription with wecutil es and wecutil gs <subscription name> ? Can you tell us which Windows' edition you use on the collector side ?
    – Swisstone
    Aug 15, 2019 at 10:49
  • Only 1 client was connected when it failed. Yes, both of these commands run fine. Currently the collector is using Windows 10 Enterprise 1803.
    – Jesse
    Aug 15, 2019 at 19:16


You must log in to answer this question.

Browse other questions tagged .