Skip to main content
Question

WEF Source, a subscription policy contains invalid configuration.

  • March 11, 2025
  • 1 reply
  • 117 views
J

When configuring the WEF source, Stream shows the source as working, but the Windows Event Forwarding plugin event logs show: Error Event ID: 107 A subscription policy contains invalid configuration.

How do I overcome this error?

    1 reply

    J
    • John Pondrom
    • Employee
    • March 11, 2025

    This is error is caused by a syntax mismatch when you configure the target subscription manager.

    Cribl suggest using a GPO to do so by setting the Configure Target Subscription Manager Policy.

    The most common cause of this error will be missing the “Server=“ that prepends the FQDN or IP being used in the policy.

    Use the following syntax when using the HTTPS protocol:

    Server=

    It will look like this when correct:

    Server=https://mycriblserver1.xxxxxxxxx.Xxxx.local:5986/wsman/SubscriptionManager/WEC,Refresh=60,IssuerCA=#######

    It will look something like the below when incorrect, and will most likely be missing the “Server=“ from the string.

    https://mycriblserver1.xxxxxxxxx.Xxxx.local:5986/wsman/SubscriptionManager/WEC,Refresh=60,IssuerCA=#######https://:5986/wsman/SubscriptionManager/WEC,Refresh=,IssuerCA

    Terms & ConditionsAccessibility statement