At initialization time, the EventLog Remoting Protocol server MUST register the RPC interface and begin listening on the RPC well-known endpoint that is specified in section 2.1. The server then MUST wait for client requests.
By default, events produced by unregistered event sources are sent to the application event log. Therefore, the server creates a live event log with the name Application, if one does not already exist. If creation of the event log (with the name Application) fails, the EventLog Remoting Protocol server does not start.