Syslog-ng Agent Event Error: Can't open publisher metadata; publisher='gupdate', error='The system cannot find the file specified.\x0d\x0a' (4265604)

Syslog-ng Agent Event Error: Can't open publisher metadata; publisher='gupdate', error='The system cannot find the file specified.\x0d\x0a'

Syslog-ng event error:

Can't open publisher metadata; publisher='gupdate', error='The system cannot find the file specified.\x0d\x0a'

This issue is due to newer Windows event log implementation (called EVTX) that does not store the entire message, only a reference ID.

In this case Chrome (gupdate) does not register its update service per Windows specifications.

You may see another informational event log related to the same event as the one Syslog-ng is reporting the error on. In this case it looks like this:

Informational message from Google update, gupdate:
"The description for Event ID 0 from source gupdate cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event. The following information was included with the event: Service stopped"

To resolve the Syslog-ng event error message:

a.) Create a gupdate key at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application

b.) Create a string value named EventMessageFile and set it to:

%windir%\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll

NOTE - If for some reason you only have .NET 2.0/3.5, change v4.0.30319 to v2.0.50727