WinSyslog Event ID 11106: Windows Event Log cleared and saved#

Answer#

The Event Log Monitor cleared the configured Windows Event Log after saving its contents.

Event details#

Event ID: 11106
Severity: Information
Component: Event Log Monitor service
Windows Event Log source: AdisconWinSyslog
Available since: 26.07
Message pattern: Windows Event Log cleared and saved. Additional detail: {event_detail}

Possible causes#

The configured Windows Event Log channel is missing, disabled, inaccessible, or no longer matches the saved collection position.
The service account cannot read the channel or provider metadata, or the channel was cleared or recreated.

Immediate checks#

Identify the exact channel, collection mode, saved position, and service account.
Confirm that Windows reports the channel enabled and readable in the service-account context.
Use one safe test event to verify collection before resetting any saved position.

Detailed procedures#

Verify Event Log channel access and bookmark state — Confirm channel existence, enablement, account access, and collection position.
Collect an Event ID and neighboring product events — Preserve the complete event and the product events immediately before and after it.
Export configuration and collect a bounded debug log — Create a text configuration export and time-bounded debug capture, then disable debugging.

Verify the result#

Repeat or monitor the affected operation and confirm that Event ID 11107 does not recur and that event log monitor service processing continues.

Evidence to collect#

The complete Windows Application Event Log entry, including all event detail.
The product name, exact version, service account, and event timestamp with time zone.
A configuration export and debug log covering the same time window, with secrets removed.

Escalation#

This event normally records state rather than a failure. Escalate only when the state was unexpected or the associated operation does not recover.