0

I need to retrieve the event logs from an XP embedded machine which doesn't have the Event Viewer, to an XP pro machine with the Event Viewer and then view the logs.

Whenever I move an event log it seems to become corrupted and I get the message "Unable to complete the operation on SysEvent.evt. The event log file is corrupted." when I try to open it in Event Viewer.

This happens even when the logs are from the same machine, and copied to the same folder as the rest of the logs, i.e.

 command line -> cd C:\Windows\system32\config -> copy SysEvent.evt SysEvent2.evt

The original log opens without a hitch. I also tried following this guide http://support.microsoft.com/default.aspx?scid=kb;en-us;315417&sd=tech but I believe this should only be neccessary if you're moving the event log to an unprotected folder.

Either way I am unable to open any log file once I have copied and pasted it.

Any ideas?

Thanks,

Bill.

1 Answer 1

2

Open the Event Log with a remote Event Viewer. Save to local machine. Open locally saved copy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .