When configuring the WEF source, Stream shows the source as working, but the Windows Event Forwarding plugin event logs show: Error Event ID: 107 A subscription policy contains invalid configuration.
How do I overcome this error?
This is error is caused by a syntax mismatch when you configure the target subscription manager.
Cribl suggest using a GPO to do so by setting the Configure Target Subscription Manager Policy.
The most common cause of this error will be missing the “Server=“ that prepends the FQDN or IP being used in the policy.
Use the following syntax when using the HTTPS protocol:
It will look like this when correct:
It will look something like the below when incorrect, and will most likely be missing the “Server=“ from the string.