Network Management

Solarwinds Self-Hosted Platform Log Viewer or Log Analyzer is not showing some Windows Event IDs

This article discusses an issue where Windows Event IDs are visible in the local Windows Event Viewer on the server polled by Solarwinds Agent but do not appear in Log Viewer / Log Analyzer.

First published date

5/1/2026 4:11 PM

Last published date

5/1/2026 4:15 PM

Overview

This article explains why some Windows Event IDs appear in the local Windows Event Viewer but not in Log Viewer / Log Analyzer. It walks through checking Log Analyzer discard rules and the advanced Windows Events plugin query to ensure the desired Event IDs are not being filtered out and are explicitly whitelisted.

It also highlights an architectural limitation of the SolarWinds Agent Windows Events plugin because it uses a subscription-based model that depends on the Windows Event Log service.

Product section

Log Analyzer

Resolution

Step 1: Check discard rules

  1. In the SolarWinds Web Console, go to Alerts & Activity → Syslogs\Traps

  2. Click on the Settings on the Top Right corner 

  3. In the Processing Tab, Check Windows Events

  4. Review discard rules related to Windows events:

    • Rules dropping events by source, channel, level, or Event ID range.

  5. Confirm that the Event ID you are looking for is not matched by any discard rule:

    • If it is, disable the rule or edit it so that the required Event ID is not discarded.

  6. Save the configuration.

Key check: Check the discard rule configuration to ensure the Event ID you are trying to monitor is not being discarded.

Step 2: Check advanced configuration (query / whitelist)

  1. Open the advanced configuration for the Windows Events plugin (agent/plugin configuration or central log configuration, depending on your setup).

  2. Locate the query under LogManagement.WindowsEvents 

  3. Verify that the Event ID you are looking for:

    • Is explicitly whitelisted (included), or

  4. Modify the query if necessary to ensure that the Event ID is in scope.

Key check: Check the query from advanced configuration to confirm the Event ID you are looking for is whitelisted and not filtered out.

Step 3: Understand events that will not be monitored

Even with discard rules and advanced configuration correctly set, some Windows events will not be monitored by the SolarWinds Agent Log Analyzer plugin for Windows Events due to its dependency on the Windows Event Log service and subscription-based model.

Specifically:

  • Events tied to the lifecycle of the Windows Event Log service itself (for example, 1100, 6005, 6006) are written at the exact moment the service and its subscription channel are stopping or starting.

  • At that moment, the agent’s subscription channel:

    • Is being terminated, or Has not yet been recreated.

  • Because the channel is unavailable, these events cannot be delivered to the agent and therefore will not be monitored, even though they appear in Windows Event Viewer.

More generally:

  • Any Windows Event that is generated while the Windows Event Log service is stopped or the subscription is down:

    • Will not be collected by the Windows Events plugin.

    • Will not appear in Log Analyzer / Log Viewer.

In this case,  you may use SAM Windows Event Log Monitor as an alternative.