How to Delete Corrupt Event Viewer Log Files

• Microsoft Windows NT Workstation versions 3.51 and 4.0
• Microsoft Windows NT Server versions 3.51 and 4.0

SYMPTOM

When you launch Windows NT Event Viewer, one of the following error messages may occur if one of the *.evt files is corrupt:

   The handle is invalid

   Dr. Watson Services.exe
   Exception: Access Violation (0xc0000005), Address: 0x76e073d4

   Event Viewer
   Remote Procedure Call failed

CAUSE

The Event Viewer Log files (Sysevent.evt, Appevent.evt, Secevent.evt) are always in use by the system, preventing the files from being deleted or renamed. The EventLog service cannot be stopped because it is required by other services, thus the files are always open. This article describes a method to rename or move these files for trouble-shooting purposes.

RESOLUTION

WARNING: Using Registry Editor incorrectly can cause serous problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it.

NTFS Partition

1. Click the Start button, point to Settings, click Control Panel, and then double-click Services.

2. Select the EventLog service and click Startup. Change the Startup Type to Disabled, and then click OK. If you are unable to log on to the computer but can access the registry remotely, you can change the Startup value in the following registry key to 0x4:

         HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
   

3. Restart Windows NT.

   NOTE: When the system starts up, several services may fail; a message informing the user to use Event Viewer to review errors may appear.

4. Rename or move the corrupt *.evt file from the following location:

         %SystemRoot%\system32\config
   

5. In Control Panel Services tool, reenable the EventLog service by setting it back to the default of Automatic startup, or change the registry Startup value back to 0x2.

1. Boot to a MS-DOS prompt using a DOS bootable disk.

2. Rename or move the corrupt *.evt file from the following location:

   %SystemRoot%\system32\config.

3. Remove the disk and restart Windows NT.