Windows Event ID 1001 - APPCRASH in wevtsvc.dll

Windows Event ID 7034 - The Windows Event Log service terminated unexpectedly

All Windows event collection on the host stops until the Event Log service restarts

On Windows Server 2025, applying a channel filter to the ForwardedEvents channel can cause the Windows Event Log service (wevtsvc) to become unresponsive. While the service is down, all Windows event collection on the affected host stops. This is a Microsoft defect with no fix available at the time of writing.

The wineventlog source reads events through the Windows winevt API (EvtSubscribe). Any filter you configure, such as providers, onlyEventIDs, excludeEventIDs, levels, or a custom query, is compiled into an XPath query that the Windows Event Log service evaluates before any event reaches the Collector. The Collector only receives events that the service returns.

This means the Collector inherits the behavior and defects of the Windows Event Log service's own query engine.

On Windows Server 2025, evaluating a filtered query against the ForwardedEvents channel (a Windows Event Forwarding / WEC collector channel) can cause the Windows Event Log service to become unresponsive. The defect is not specific to the Collector; it is reproducible with PowerShell alone:

Get-WinEvent -FilterHashtable @{LogName='ForwardedEvents'; Id=4624} -MaxEvents 10

Get-WinEvent -LogName ForwardedEvents -FilterXPath "*[System[EventID=4624]]"

Both commands fail with The RPC server is unavailable or The remote procedure call failed.

On Windows Server 2025, subscribe to ForwardedEvents without any channel filter. Use a transform to filter events inside the Collector instead. Transforms run entirely within the Collector process and never reach the Event Log service's query engine.

sources:
  forwarded:
    type: wineventlog
    sink: logscale
    channels:
      # Do not add providers, onlyEventIDs, excludeEventIDs, levels, or query here.
      - name: ForwardedEvents
        transforms:
          - type: regex_filter
            field: windows.EventID
            pattern: '^(4624|4625|4634)$'
            mode: include

Without a server-side filter, the Event Log service delivers every forwarded event to the Collector, which then discards unwanted events. On a busy WEC collector this increases CPU and I/O usage compared to server-side filtering. To reduce this overhead, consider narrowing the WEF subscription query on the source computers so that unwanted events are never written to ForwardedEvents in the first place.

This is a Microsoft defect. There is no hotfix or KB article from Microsoft available at the time of writing. See Microsoft Q&A 5984678 for the original report.

This article will be updated when a resolution becomes available.