How Event Viewer Event log files are corrupted

　　What if the event log file is corrupted?

As one of the administrative tools included in the Microsoft Management Console, Event Viewer is used to maintain log information on your computer for related programs, security features, and system events. You can browse and manage event logs through Event Viewer, collect various types of information related to software or hardware failures, or monitor Windows security events.

If the Event Viewer reports to you that one or more log files have been compromised during system startup, you can take the following remedial action:

1. Disable Event Log service: Open Control Panel---Performance and maintenance---management tools---services (or run services.msc directly), double-click the "Event Log" service option to disable.

2. Restart Windows XP.

3. Delete the damaged log files--appevent.evt, secevent.evt, and/or sysevent.evt from the%systemroot%system32config directory (or other location). All of your existing event data will be lost, but the new log file will be created when the event Log service restarts and the new event data is collected again.

4. Re-enable and start the event Log service.

5. If the Event Log service does not start successfully, restart Windows XP.

You will not be able to delete or rename log files during the event log service run

Occurs after Windows Event Viewer is opened: The event log file is corrupted (the event, corrupt)

Solution:

1 Disable the EventLog service and reboot the computer!

2 after reboot, delete the 3 evt files under System32

Appevent.evt

Sysevent.evt

Secevent.evt

3 Start EventLog Service

Friends on the Internet have made a bat file to solve such problems. For more information please check http://www.slnis.com/2008/09/event-log-file-is-corrupt.html

The following files are presented from Windows XP or Windows 2000 English: Reg.exe, Sc.exe, Shutdown.exe, not necessarily English system, because I compare the pursuit of perfection, sometimes I will work in the traditional system, I do not like garbled! It is also not necessary to have these three files if you want this program to run properly under Windows 2000 only!

New Fixsyslogfile.bat content:

The code is as follows:

: Repair Event log file is corrupted Fixsyslogfile.bat, set log service to be disabled to increase the registry automatic startup entry Restart after the restart Fixsyslogfileend.bat, restart by:shirching

sc config Eventlog start= disabled

REG ADD "hkey_local_machinesoftwaremicrosoftwindowscurrentversionrunonce"/V fixlogfile/t reg_sz/d%windir% Fixsyslogfileend.bat

Shutdown-r-T 1

: SC config Service name start= demand (set service to start manually)

: SC config service name start= disabled (set service to Disabled)

: SC Start service name (start service)

: sc stop service Name (stop service)

Then build a batch to name the Fixsyslogfileend.bat content as:

The code is as follows:

: Repair event Log files are corrupted Fixsyslogfileend.bat, delete corrupted log files and set log service to Automatic and start, new log files are created automatically, and then clear residual files by shirching 200706282339

del/f/q%WINDIR%SYSTEM32CONFIGAPPEVENT.EVT

del/f/q%WINDIR%SYSTEM32CONFIGSYSEVENT.EVT

del/f/q%WINDIR%SYSTEM32CONFIGSECEVENT.EVT

sc config Eventlog start= auto

SC start Eventlog

del/f/q%windir%reg.exe

del/f/q%windir%sc.exe

del/f/q%windir%shutdown.exe

del/f/q%windir%fixsyslogfile.bat

del/f/q%windir%fixsyslogfileend.bat

Pack five files into self-extracting, run Fixsyslogfile.bat before decompression, and run after decompression Fixsyslogfileend.bat