WinSyslog Event ID 11040: Forward Syslog delivery failed without queue protection#

Answer#

The Forward Syslog action could not deliver the current message, and the active transport or send mode did not place it in the supported action disk queue. The action is marked failed for this event.

Event details#

Event ID: 11040
Severity: Error
Component: Forward Syslog action
Windows Event Log source: AdisconWinSyslog
Available since: 26.07
Message pattern: WSError: {error_code} | Error sending syslog message: {error_detail}

Possible causes#

The syslog destination is unavailable, refusing connections, or closing the session.
DNS, routing, firewall, transport, or TLS settings prevent delivery.
The selected send mode or transport is not using action disk-queue protection.

Immediate checks#

Record the Winsock error, transport, send mode, and destination.
Test name resolution and the configured port from the product host.
Correct the destination or transport and send a new uniquely identifiable test message; evaluate queue protection if loss prevention is required.

Detailed procedures#

Resolve a destination and test its TCP port — Verify DNS, selected address, routing, and TCP establishment.
Verify sender, receiver, and queued-message recovery — Prove end-to-end recovery and backlog drainage.
Collect an Event ID and neighboring product events — Preserve the complete event and the product events immediately before and after it.
Export configuration and collect a bounded debug log — Create a text configuration export and time-bounded debug capture, then disable debugging.

Verify the result#

Confirm that the new test message arrives and Event ID 11040 does not recur.

Evidence to collect#

The complete Windows Application Event Log entry and neighboring product events from the same time window.
The exact product version, affected service or action name, and event timestamp with time zone.
The affected configuration object and a bounded debug log covering one controlled reproduction.
Remove passwords, tokens, license data, private keys, message payloads, personal data, and customer-identifying names, addresses, hostnames, domains, and network addresses before sharing evidence.

Escalation#

If the event continues after the detailed procedures, collect the listed evidence and contact Adiscon Support.