This problem can occur when there is a mismatch between the Event Collector and Receiver Data Sources. Specifically, in version 11.x, the Event Collector now performs a two-way handshake between Event Collector and Receiver. It does not transmit event data unless the Receiver has a Data Source configured for MEF retrieval, together with a configured and matching hostID.
You typically see this error if you have a Receiver Data Source that doesn't have MEF retrieval enabled and doesn't have a hostID configured that
precisely matches. The spelling and punctuation must match one in the Windows Event collector. This situation was not an issue in prior Event Collector versions. The data was sent without a check to determine if the Receiver had a target Data Source ready to receive data.
NOTE: The
Validate button in the Windows Event Collector tool does
not test the Receiver Data Source, or validate the connection to it.