WinSyslog Event ID 11104: Event Log Monitor service: Windows Event Log could not be cleared#

Answer#

Event Log Monitor service: Windows Event Log could not be cleared. The product recorded this while processing event log monitor service; the appended event detail identifies the affected object, operation, or provider error.

Event details#

Event ID: 11104
Severity: Error
Component: Event Log Monitor service
Windows Event Log source: AdisconWinSyslog
Available since: 26.07
Message pattern: Event Log Monitor service: Windows Event Log could not be cleared. Additional detail: {event_detail}

Possible causes#

The configured Windows Event Log channel is missing, disabled, inaccessible, or no longer matches the saved collection position.
The service account cannot read the channel or provider metadata, or the channel was cleared or recreated.

Immediate checks#

Identify the exact channel, collection mode, saved position, and service account.
Confirm that Windows reports the channel enabled and readable in the service-account context.
Use one safe test event to verify collection before resetting any saved position.

Detailed procedures#

Verify Event Log channel access and bookmark state — Confirm channel existence, enablement, account access, and collection position.
Collect an Event ID and neighboring product events — Preserve the complete event and the product events immediately before and after it.
Export configuration and collect a bounded debug log — Create a text configuration export and time-bounded debug capture, then disable debugging.

Verify the result#

Repeat or monitor the affected operation and confirm that Event ID 11104 does not recur and that event log monitor service processing continues.

Evidence to collect#

The complete Windows Application Event Log entry, including all event detail.
The product name, exact version, service account, and event timestamp with time zone.
A configuration export and debug log covering the same time window, with secrets removed.

Escalation#

If the event continues after the detailed procedures, collect the listed evidence and contact Adiscon Support.