WinSyslog Event ID 11146: Syslog listener stopped after an unknown exception#

Answer#

The active Syslog listener raised an exception outside its normal binding and socket error handling. The product stops retrying that listener after the failure.

Event details#

Event ID: 11146
Severity: Error
Component: Syslog listener
Windows Event Log source: AdisconWinSyslog
Available since: 26.07
Message pattern: The Syslog listener encountered an unknown exception and stopped retrying.

Possible causes#

A socket or TLS provider raised an unexpected exception.
System resource pressure disrupted the listener.
The listener encountered a product defect.

Immediate checks#

Confirm whether the configured syslog port and transport are still active.
Collect neighboring events, Windows Error Reporting data, and a bounded debug log from one controlled restart.
Escalate a reproducible failure with the collected evidence.

Detailed procedures#

Verify listener binding and Windows Firewall rules — Confirm effective address, port, transport, owning process, and inbound policy.
Collect evidence for an escalation-only runtime event — Capture a bounded reproducible support package without unsafe generic repair.
Collect an Event ID and neighboring product events — Preserve the complete event and the product events immediately before and after it.
Export configuration and collect a bounded debug log — Create a text configuration export and time-bounded debug capture, then disable debugging.

Verify the result#

Confirm that the listener remains active and receives a controlled syslog message without Event ID 11146.

Evidence to collect#

The complete Windows Application Event Log entry and neighboring product events from the same time window.
The exact product version, affected service or action name, and event timestamp with time zone.
The affected configuration object and a bounded debug log covering one controlled reproduction.
Remove passwords, tokens, license data, private keys, message payloads, personal data, and customer-identifying names, addresses, hostnames, domains, and network addresses before sharing evidence.

Escalation#

No safe general self-service repair is available for this event. Follow the escalation evidence procedure above and contact Adiscon Support.