Re: Can't open Application Log

Hi,

Thank you for posting here.

Since this issue could be occurred because various reasons, to keep this
thread clean, I recommend you to open a new thread for further discussion.
A support engineer will be assigned (maybe it will be me again).

Based on my experience, you can try the following steps to troubleshoot
this issue, as this issue is really complex, also the original post has
been redirect to phone support, if the issue persists after above steps you
may want to contact Microsoft CSS directly.
Please checkhttp://support.microsoft.com for regional support phone numbers.

Action plan:
Step 1. Set Event View settings to default
Open Event Viewer on SBS Server. Right click Application log and point to
Properties. On General Tab, click "Restore Defaults' button.


Step 2. This problem is most likely caused by corrupted log files.
Therefore, let's try to clear the event log files per the steps below:

1. Disable Event Log service
=================
a. Click Start -> Run, type services.msc and click OK.
b. Double click "Event Log" service, and set the "Startup type" to Disabled.
c. Restart the computer.

2. Rename log files
=================
a. Go to %systemroot%\system32\config folder. %systemroot% is the folder
where you install Windows. By default, it is C:\Winnt.
b. Find all the .evt files, and rename them to *.old. For example, rename
SysEvent.evt to SysEvent.old.

3. Re-enable Event Log service
==================
a. Go to services.msc, and set "Startup type" of "Event Log" service to
Automatic.
b. Restart the computer, and run Event Viewer to see if the events can be
displayed.

Step 3.
++++++++++++++++++++++++++++++++++++++++++++

You receive a "The event log file is corrupt" error message when you
WGID:453
ID: 899416.KB.EN-US CREATED: 2005-05-05 MODIFIED: 2005-06-16


Public | kbAudITPRO kbAudDeveloper


----------------------------------------------------------------------------
---
The information in this article applies to:

- Microsoft Windows Server 2003 SP1 (Version: SP1)
- Microsoft Windows Server 2003, Web Edition
- Microsoft Windows Server 2003, Standard Edition
- Microsoft Windows Server 2003, Enterprise Edition
- Microsoft Windows Server 2003, Enterprise x64 Edition
- Microsoft Windows Server 2003, Standard x64 Edition
- Microsoft Windows Server 2003, Enterprise Edition for Itanium-based
Systems
- Microsoft Windows XP Service Pack 1
- Microsoft Windows XP Professional x64 Edition

----------------------------------------------------------------------------
---

SYMPTOMS
========

After you install Microsoft Windows Server 2003 Service Pack 1 or Microsoft
Windows XP Service Pack 1, you may receive the following error message when
you try to view the system events logged in the Event Viewer:

The event log file is corrupt.

If you clear the log and restart the computer, the log will become
corrupted again.

Note The event log can still be viewed remotely from a Windows Server
2003-based computer that has pre-Service Pack 1 installed.

CAUSE
=====

This problem occurs because the network adaptor drivers do not set the
customer bit correctly as documented in the following MSDN Web site:
http://msdn.microsoft.com/library/en-us/debug/base/event_identifiers.asp
This leads to the corruption in event log when the network adaptor drivers
try to log their own events.

RESOLUTION
==========

Windows Server 2003
-------------------

Hotfix Information
------------------
A supported hotfix is now available from Microsoft, but it is only intended
to correct the problem that is described in this article. Only apply it to
systems that are experiencing this specific problem. This hotfix may
receive additional testing. Therefore, if you are not severely affected by
this problem, Microsoft recommends that you wait for the next Windows
Server 2003 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support
Services to obtain the hotfix. For a complete list of Microsoft Product
Support Services phone numbers and information about support costs, visit
the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS:
http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS

Note In special cases, charges that are ordinarily incurred for support
calls may be canceled if a Microsoft Support Professional determines that a
specific update will resolve your problem. The usual support costs will
apply to additional support questions and issues that do not qualify for
the specific update in question.


Prerequisites

You must have Microsoft Windows Server 2003 Service Pack 1 installed.



Restart requirement

You must restart the computer after you apply this hotfix.


Hotfix replacement information

This hotfix does not replace any other hotfixes.


File information
The English version of this hotfix has the file attributes (or later) that
are listed in the following table. The dates and times for these files are
listed in coordinated universal time (UTC). When you view the file
information, it is converted to local time. To find the difference between
UTC and local time, use the "Time Zone" tab in the Date and Time tool in
Control Panel.
Windows Server 2003 with Service Pack 1 (SP1), x86-based versions

Date Time Version Size File name
--------------------------------------------------------------
12-May-2005 03:14 5.2.3790.2443 69,120 Eventlog.dll


Windows Server 2003 with SP1, Enterprise Edition for Itanium-based Systems

Date Time Version Size File name
--------------------------------------------------------------
11-May-2005 12:51 5.2.3790.2443 184,832 Eventlog.dll IA64


Windows Server 2003 with SP1, x64-based versions

Date Time Version Size File name
--------------------------------------------------------------
11-May-2005 12:50 5.2.3790.2443 130,560 Eventlog.dll

Note You must clear the corrupted log with the hotfix applied.


Windows XP
----------

Hotfix Information
------------------
A supported hotfix is now available from Microsoft, but it is only intended
to correct the problem that is described in this article. Only apply it to
systems that are experiencing this specific problem. This hotfix may
receive additional testing. Therefore, if you are not severely affected by
this problem, we recommend that you wait for the next Windows XP service
pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support
Services to obtain the hotfix. For a complete list of Microsoft Product
Support Services telephone numbers and information about support costs,
visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support
calls may be canceled if a Microsoft Support Professional determines that a
specific update will resolve your problem. The usual support costs will
apply to additional support questions and issues that do not qualify for
the specific update in question.


Prerequisites

You must have Microsoft Windows Server 2003 Service Pack 1 installed.



Restart requirement

You must restart the computer after you apply this hotfix.


Hotfix replacement information

This hotfix does not replace any other hotfixes.


File information
The English version of this hotfix has the file attributes (or later) that
are listed in the following table. The dates and times for these files are
listed in coordinated universal time (UTC). When you view the file
information, it is converted to local time. To find the difference between
UTC and local time, use the "Time Zone" tab in the Date and Time tool in
Control Panel.
Windows XP, Professional Edition for x64-based versions

Date Time Version Size File name
--------------------------------------------------------------
11-May-2005 12:50 5.2.3790.2443 130,560 Eventlog.dll

Note You must clear the corrupted log with the hotfix applied.


STATUS
======

Microsoft has confirmed that this is a problem in the Microsoft products
that are listed in the "Applies to" section of this article.

MORE INFORMATION
================

For additional information, click the following article number to view the
article in the Microsoft Knowledge Base:

KBLink:824684.KB.[LN]: Description of the standard terminology that is
used to describe Microsoft software updates


++++++++++++++++++++++++++++++++++++++++++++



Thank you for your understanding and we look forward to hearing from you
soon.

Have a nice day!



Best Regards,

Chace Zhang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------
| From: david.beasley@xxxxxxxxx
| Newsgroups: microsoft.public.windows.server.sbs
| Subject: Re: Can't open Application Log
| Date: 4 Sep 2006 22:49:46 -0700
| Organization: http://groups.google.com
| Lines: 6
| Message-ID: <1157435386.814075.230490@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
| References: <1154335906.019293.281330@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
| <1154775207.981624.8290@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
| <2tCyBwuuGHA.2952@xxxxxxxxxxxxxxxxxxxxx>
| NNTP-Posting-Host: 210.8.187.162
| Mime-Version: 1.0
| Content-Type: text/plain; charset="iso-8859-1"
| X-Trace: posting.google.com 1157435391 2435 127.0.0.1 (5 Sep 2006
05:49:51 GMT)
| X-Complaints-To: groups-abuse@xxxxxxxxxx
| NNTP-Posting-Date: Tue, 5 Sep 2006 05:49:51 +0000 (UTC)
| In-Reply-To: <2tCyBwuuGHA.2952@xxxxxxxxxxxxxxxxxxxxx>
| User-Agent: G2/0.2
| X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6,gzip(gfe),gzip(gfe)
| X-HTTP-Via: 1.1 OSCAR
| Complaints-To: groups-abuse@xxxxxxxxxx
| Injection-Info: b28g2000cwb.googlegroups.com; posting-host=210.8.187.162;
| posting-account=DnnZew0AAAA6Z0926eZm-wkkMvOaAHw-
| Path:
TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTFEEDS02.phx.gbl!msrtrans!n
ews-spur1.maxwell.syr.edu!news.maxwell.syr.edu!postnews.google.com!b28g2000c
wb.googlegroups.com!not-for-mail
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:295250
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| We have been having the same problems for almost a month now.
|
| I have been through all the different groups I can find and I haven't
| found anything that helps yet. I can export the event log and view it
| on my PC but if I try to view it on the server the event viewer crashes.
|
|

.