# Missed Events
**URL:** https://discuss.elastic.co/t/missed-events/320702
**Category:** Beats
**Tags:** winlogbeat
**Created:** [December 7, 2022, 4:25pm UTC](https://discuss.elastic.co/t/missed-events/320702 "2022-12-07T16:25:52Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)
#### Post date: [December 7, 2022, 4:25pm UTC](https://discuss.elastic.co/t/missed-events/320702/1 "2022-12-07T16:25:52Z")
I have a situation where we are receiving Windows Event ID 3000 _sometimes_ but not other times. This is very problematic, as the event is used to [troubleshoot process exits](https://community.qlik.com/t5/Official-Support-Articles/GFlags-Find-out-what-killed-silently-a-windows-process/ta-p/1770675). The endpoint uses Windows Event Forwarding (WEF) to send logs to a server running both Windows Event Collector (WEC) and Winlogbeat. Winlogbeat [collects the forwarded events](https://www.elastic.co/guide/en/beats/winlogbeat/master/configuration-winlogbeat-options.html#_event_logs_forwarded) and sends on to ES. The WEC configuration uses [source-initiated subscriptions](https://learn.microsoft.com/en-us/windows/win32/wec/setting-up-a-source-initiated-subscription), one of which is set up to receive all events from the Windows Application event channel (which includes EID 3000). As I mentioned, that event comes through sometimes, but not always. Any suggestions on how to troubleshoot this are much appreciated!
...alternatively - if this can't be solved - how do I _ensure_ a specific EID is sent to ES and never missed?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2023, 6:26pm UTC](https://discuss.elastic.co/t/missed-events/320702/2 "2023-01-04T18:26:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.