Event ID 30 — Publishing

Applies To: Windows Server 2008 R2

When an event log is initialized and ready to receive events, all event providers that declared their intent to publish events into the log are enabled to do so. When the Event Log service cannot enable a provider, that provider will not be able to send events into the log. When this happens, the diagnostic and troubleshooting capabilities of administrators, support personnel, developers, and automated utilities could be compromised.

Event Details

Product: Windows Operating System
ID: 30
Source: Microsoft-Windows-Eventlog
Version: 6.1
Message: The event logging service encountered an error (%1) while enabling publisher %3 to channel %2. This doesn't affect operation of the channel, but does affect the ability for the publisher to raise events to the channel. One common reason for this error is that Provider is using ETW Provider Security and has not granted enable permissions to the Eventlog service identity.


Revert trace utility settings

In most cases, the publishing settings are not configured by the administrator using either the Event Viewer or the command-line utility wevtutil. The settings can be configured using trace configuration utilities. If any trace configuration utilities were recently used, the administrator must revert the settings. Otherwise, contact technical support for the publisher.


Use the Event Viewer to read the System log on the local computer after the computer has been restarted. Verify that events 22 or 30 do not appear in the System log after the computer was restarted.


Management Infrastructure