asked on

Event Forwarder Event ID 111

I have configured a Windows Server 2008 R2 Event Collector in our Domain. It is a stand alone server. I have 2 Windows 7 laptops setup for testing this. So far I have collected events from both laptops to the Forwarded Events Log on the Collector. The subscriptions are Source Initiated. The events that are trying to be collected are from the System Logs of both laptops and Group Policy and General Errors. However all that comes to the Collector are Event ID 111 and not the specific events that were requested. I have searched Microsoft and generally the Internet and no one seems to have an answer to this question as of yet.

thanks

Radhakrishnan

Hi,

This event means that the DNS server could not create a thread. This is most likely caused by your computer running out of available resources.

Restart the DNS Server service from services.msc on the server.

If the service status does not change to Started, you may need to reboot the computer to resolve the issue. Even if the status has changed to Started, you should check the Microsoft Windows event log for any events relating to DNS server that have been logged at or since the time you restarted the service. If any DNS server error events have been logged, you should reboot your computer in an attempt to resolve the issue.

btan

You may want to see this discussion which states steps the user checks
http://social.technet.microsoft.com/Forums/en-US/winserverManagement/thread/93cd6c41-c502-48bc-9db7-077405fff829/

specifically there is some captures listed in this as well
http://1ask2.com/Windows7/Event%20Subscription.html

ASKER CERTIFIED SOLUTION

kopp3162

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

btan

Saw this step by step on configuring the reader and collector in such mixed environment but eventually they stated event 111 can be ignored as this is just the initial bookmark event that Event forwarding plugin uses to mark the beginning of a subscription; it can be ignored. Doesnt seems to fit the bill. Nonetheless, glad you have it working

http://blogs.technet.com/b/mspfe/archive/2011/11/22/setting_2d00_up_2d00_security_2d00_event_2d00_log_2d00_subscriptions_2d00_with_2d00_windows_2d00_server_2d00_20032008.aspx