"0x57" error when you use the wecutil ss /c: command to update an Event Forwarding subscription

Gælder for: Windows Server 2016Windows Server 2012 R2

Symptoms


You use the wecutil tool to manage Windows Event Forwarding subscriptions on one or more Windows Server-based computers. You try to update the subscriptions by using a configuration file. To do this, you run a command such as the following:

wecutil.exe ss /c:<configfile>.xml

However, you receive error messages such as the following:

Error: Too many arguments are specified. Error = 0x57
The parameter is incorrect.

Error: Failed to set SubscriptionType property. Error = 0x57.
The parameter is incorrect.

Cause


This issue occurs if the configuration file that you use together with the wecutiltool contains a SubscriptionType element.

Resolution (applies to source-initiated subscriptions)


If you are updating source-initiated or "push" subscriptions, you can resolve this issue by editing the configuration file. By changing the SubscriptionType element to a comment,  you remove the parameter conflict. To do this, follow these steps:

  1. Open the configuration XML file.
  2. Look for the following text:
    <SubscriptionType>SourceInitiated</SubscriptionType>
  3. Change the text to a comment. For example:
    <!--<SubscriptionType>SourceInitiated</SubscriptionType>-->
  4. Save the configuration XML file.

After you edit the configuration file, run wecutil again. For example:

wecutil.exe ss /c:<configfile>.xml

Workaround (applies to collector-initiated subscriptions)


You cannot update a collector-initiated or "pull" subscription by using the wecutil tool. Instead, delete the existing subscription and create a new subscription. To do this, use the following commands:

wecutil ds <oldsubID>wecutil cs <configfile>.xml

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More information


For more information about the wecutil tool, see Wecutil.exe.