The Log Forwarder stops forwarding Event Logs as Syslog messages after selecting all items in creating a subscription. The following error appears when the Log Forwarder service is restarted:
Unable to setup Windows Event Log subscribers. Subscribe failed with error 15022, The requested operation cannot be performed over an enabled direct channel. The channel must first be disabled before performing the requested operation.
Perform any of the following workarounds:
Log Forwarder does not support Analytic and Debug Logs.