WinSyslog Event ID 11157: Existing archive could not be renamed to prevent overwrite#

Answer#

The product found an archive-name collision but could not rename the existing archive to the protected fallback name. It does not intentionally overwrite the existing file.

Event details#

  • Event ID: 11157

  • Severity: Warning

  • Component: Log rotation

  • Windows Event Log source: AdisconWinSyslog

  • Available since: 26.07

  • Message pattern: Prevent archive overwrite rename failed: {archive_path}

Possible causes#

  • The archive file is locked by another process.

  • The service account lacks rename permission.

  • The archive directory is unavailable, read-only, or out of space.

Immediate checks#

  1. Identify and preserve the existing archive file.

  2. Check file locks, directory permissions, and free space under the product service account.

  3. Remove the blocking condition and perform a controlled rotation.

Detailed procedures#

Verify the result#

Confirm that archive-name collisions are resolved without overwriting files and Event ID 11157 does not recur.

Evidence to collect#

  • The complete Windows Application Event Log entry and neighboring product events from the same time window.

  • The exact product version, affected service or action name, and event timestamp with time zone.

  • The affected configuration object and a bounded debug log covering one controlled reproduction.

  • Remove passwords, tokens, license data, private keys, message payloads, personal data, and customer-identifying names, addresses, hostnames, domains, and network addresses before sharing evidence.

Escalation#

If the event continues after the detailed procedures, collect the listed evidence and contact Adiscon Support.