WinSyslog Event ID 11173: An event failed while the main queue applied its rules#

Answer#

A normal diagnostic exception escaped while a queue worker applied the selected ruleset to one event. The product records the error and finishes that event instead of leaving it in the in-memory queue.

Event details#

Event ID: 11173
Severity: Error
Component: Main message queue
Windows Event Log source: AdisconWinSyslog
Available since: 26.07
Message pattern: Queue rule-processing error: {error_detail}

Possible causes#

A filter, action, or property operation raised a diagnostic exception.
The event or ruleset contains an invalid value.
A destination or provider used during rule processing failed.

Immediate checks#

Use the embedded error and neighboring action events to identify the failing rule operation.
Preserve the affected ruleset and a sanitized sample event, then reproduce with one controlled event.
Correct the identified operation and verify subsequent queue processing.

Detailed procedures#

Interpret a Windows or Winsock error code — Translate a numeric code without losing its operation or subsystem context.
Verify file paths, permissions, and free space — Check expansion, existence, ACLs, service-account context, and storage.
Resolve a destination and test its TCP port — Verify DNS, selected address, routing, and TCP establishment.
Test an ODBC connection in the product context — Verify ODBC provider, architecture, authentication, connectivity, and a minimal query.
Test an OLE DB connection in the product context — Verify OLE DB provider, architecture, authentication, connectivity, and a minimal query.
Validate configuration and reload it safely — Back up, inspect, correct, and test the exact invalid configuration object.
Collect an Event ID and neighboring product events — Preserve the complete event and the product events immediately before and after it.
Export configuration and collect a bounded debug log — Create a text configuration export and time-bounded debug capture, then disable debugging.

Verify the result#

Confirm that controlled events complete the ruleset and queue depth decreases without Event ID 11173.

Evidence to collect#

The complete Windows Application Event Log entry and neighboring product events from the same time window.
The exact product version, affected service or action name, and event timestamp with time zone.
The affected configuration object and a bounded debug log covering one controlled reproduction.
Remove passwords, tokens, license data, private keys, message payloads, personal data, and customer-identifying names, addresses, hostnames, domains, and network addresses before sharing evidence.

Escalation#

If the event continues after the detailed procedures, collect the listed evidence and contact Adiscon Support.