Windows event subscription creation issue, error: Windows Event Forward plugin can't read any event from the query since the query returns no active channel

Question

Hi,

I have enabled Windows event forwarding in the source machine using the following commands:

```` Enable-PSRemoting -Force
winrm quickconfig -quiet
$logName = "Microsoft-Windows-DNSServer/Analytical"
# Create a new EventLogConfiguration object
$log = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $logName
# Enable the log
$log.IsEnabled = $true
# Save the changes
$log.SaveChanges()
$groupName = "Event Log Readers"
# Verify the computer exists
$computer = Get-ADComputer -Identity $collectorName -ErrorAction Stop
Add-ADGroupMember -Identity $groupName -Members $computer

using command:`
Enable-PSRemoting -Force
winrm quickconfig -quiet

`Now when I create a subscription for collector initiated with the following powershell script:`
# Subscription details
$subscriptionName = "pull-subscription"
$eventQuery = @"
<QueryList>
  <Query Id="0" Path="Microsoft-Windows-DNSServer/Analytical">
    <Select Path="Microsoft-Windows-DNSServer/Analytical">*[System[(EventID=261)]]</Select>
  </Query>
</QueryList>
"@


# Create the subscription XML
$subscriptionXML = [xml]@"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>pull-subscription-2</SubscriptionId>
  <!-- Use Normal (default), Custom, MinLatency, MinBandwidth -->
  <ConfigurationMode>MinLatency</ConfigurationMode>
  <SubscriptionType>CollectorInitiated</SubscriptionType>
  <Description>Subscription for DNS Server Analytical events</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <Content>Events</Content>
  <ReadExistingEvents>true</ReadExistingEvents>
  <EventSources>
    <EventSource>
      <Address>server2.domain.com</Address>
      <Transport>HTTP</Transport>
      <Port>5985</Port>
    </EventSource>
  </EventSources>
  <Query><![CDATA[$eventQuery]]></Query>
</Subscription>
"@

# Output the final XML
$subscriptionXml.OuterXml

# Create the subscription using wecutil
$subscriptionFile = [System.IO.Path]::GetTempFileName()
$subscriptionXml.Save($subscriptionFile)
wecutil cs $subscriptionFile
Remove-Item $subscriptionFile

`The runtime status of the subscription shows error: `Windows Event Forward plugin can't read any event from the query since 
the query returns no active channel. Please check channels in the query and make sure they exist and you have access 
to them.

`But I can see the query can run on the local machine and retrieve events.`

`It shows no error if I modify the $eventQuery to` @"
<QueryList>
  <Query Id="0" Path="Microsoft-Windows-DNS-Client/Operational">
    <Select Path="Microsoft-Windows-DNS-Client/Operational">*</Select>
  </Query>
</QueryList>
"@

`How can I resolve the issue? Your help is highly appreciated.

Answer 1

Without an error code that points to a particular problem means we can only use the error text you provided. That may be enough, though.

https://serverfault.com/questions/763026/event-log-subscription-returns-error-code-0x138c

https://rockyprogress.wordpress.com/2011/12/04/security-event-log-collection-from-a-domain-controller/

You added the name of the server to the "Event Log Readers" group (I'm assuming you've waited a sufficiently long time to allow for AD replication to propagate the addition), but I think you need to add the "Network Service" account to the group.

You may also need to modify the Channel Access permission on the remote machines' log file.