Event Log forwarding subscription is unsubscribed

[yoni.kibrik]

I setup a source initiated event log subscription to some computer in my domain.

The logs are collected in a collection server (windows 2012R2).

From time to time some of the hosts appear inactive in:

wecutil gr SubscriptionName

When I look at the Eventlog-ForwardingPlugin log I see event id 103 "The subscription SubscriptionName is unsubscribed."

After some time I see event id 100 "The subscription SubscriptionName is created successfully." And then the events are forwarded again.
Why is that keeps happening?

Continue reading...