ATTN WINDOWS 200x GURUS

[DuhCustom]

Hey there, I have been having this problem pop up randomly on all the servers that I have (maybe it doesn't pop up on the 2003, can't remember), and I have not been able to find a solution. Google is no help, Microsoft KB is useless,and Ars technica is down for maintenance, so here I am.

Anywho, here is the problem:

Randomly, when I open up Event Viewer, it will tell me that there are x number of entries in the Application Log, but when I click on Application, the screen will be clear, I can click on logs, but they are invisible, and hence not very helpful. Then, when i click on other logs, it will tell me there are 0 logs, when i know damn well there are thousands. When I click back to where there were x logs before, it now tells me there are 0 logs. Please help me, it is impossible to check my network and servers without event viewer!

 

[Smilin]

First isolate if this is a problem with your event logs or your event viewer. Checking your events from a remote computer should do the trick.

If you determine you have corrupt event logs (you'll often see services.exe spike to 100% as another symptom) then you should delete the appropriate .evt file from your system32\config folder while in recovery console. These files are always in use so recovery console is the only way. Clearing the logs will not remove corruption, only deleting the files. Next boot the files will recreate.

If you determine it's a problem with your event viewer the troubleshooting steps are going to get a bit complicated for a single thread. Running "SFC /SCANNOW" would not be a bad place to start.

Also, keep in mind if your logs are fricking huge it can take MINUTES to refresh views.

Good luck.

 

[Sianath]

For Windows 2000 servers, there is a hotfix for corrupt log files. I'll find it tomorrow and post the link to the article if you like.

On top of that, please don't delete anything you might need later. Go into the recovery console and rename the sysevent.evet and appevent.evt files to *.old or some other extension. Same effect as deleting (windows recreates the files) but this way you don't lose them if it turns out to be something other than actual corruption.

 

[Abzstrak]

I've seen this happen before, I just exported the logs, then started from scratch with new ones and all was good... and the exported ones seemed to work fine after being exported. I'm interested in that fix too Sianath.

 

[LiLithTecH]

The HOTFIX was included in SP4.

 

[Sianath]

SP4 version of eventlog.dll --> 5.0.2195.6716

Hotfix version of eventlog.dll (scheduled for SP5) --> 5.0.2195.6866

829246 Event Logs Are Corrupted
http://support.microsoft.com/?id=829246