Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.




I didn't get any help on the TechNet forum so I'm going to try my luck here :).


Our web server is running Server 2008 SP1, 64-bit Standard Edition. For the past week or so, we've been experiencing repeated corruption in the Application event log. Each time, we can fix the corruption by clearing the log. But the corruption always comes back, sometimes within an hour or two.

We have a PowerShell script which checks the event log periodically and emails us about error events. Once the log has become corrupt, running "get-eventlog Application" from PowerShell produces the following output:

Get-EventLog : Cannot read log entry number 696. The event log may be corrupt. At line:1 char:13
+ get-eventlog <<<< Application

Usually there are several valid event log entries displayed before the corruption error.

The other event logs (System, Security, and so on) are not experiencing this corruption.

If I look at the Application log in the event viewer, I see several events with no information at all. In the list view, they show the "information" icon, but all other columns are blank. In the "general" and "details" tabs, everything is blank.


I thought about disk corruption. But since this is only affecting the event log, I'm skeptical that the disks are the cause. The server has a single RAID-1 array which shows a status of healthy. Write caching is disabled. All applications and sites hosted on the server appear to be working fine; only the event log is having problems.

On TechNet, someone replied saying it sounded like a PowerShell problem - but it isn't, since the corruption is also visible through the Event Viewer GUI.


I'd appreciate any ideas you might have for finding the cause of this problem...

Thanks,
Richard

share|improve this question
    
As any application can write (and decide what) to that log it might be one of the running apps that is causing the problems somehow... –  Oskar Duveborn May 20 '09 at 0:53
2  
Thanks Oskar. The server is running our custom .NET web apps... if any of them write to the event log, they would be using the standard .NET API for that. I hope it isn't possible to corrupt the event log that way - hopefully the API validates the input and prevents corrupt data from getting in. But you're right, we should definitely take a look at our apps and see what they're writing. –  Richard Beier May 20 '09 at 20:29
1  
Hi Richard, I realize this is an old post, but did you ever find a resolution to this problem? Thanks –  Jon Feb 7 '11 at 11:27
add comment

3 Answers

up vote 1 down vote accepted
  1. Per Oskar Duveborn's suggestion try disabling applications to see if you can isolate one causing the log corruption. Is there any pattern to good logs just before it goes corrupt?

  2. Maybe there is something wrong with hard drive or location the Event Log being stored at, which causes the corruption. See kb 315417 to try moving it to a different folder, or better yet, a different hard drive. At least temporarily to see if that is the problem.

share|improve this answer
    
Thanks Jack - these are both good ideas. We saved all the corrupt event logs every time we cleared it - so I'm going to go back over them and try to find a pattern. Also, I'll try moving the event log files as you suggested. Thanks, Richard –  Richard Beier May 20 '09 at 20:31
add comment

Richard

Any pattern in the system log ?

Also try using dumprel.exe to read the corrupt log files. http://support.microsoft.com/kb/129266

share|improve this answer
    
Thanks, I'll try this. We've actually been busy with a ton of other things so we haven't had time to finish investigating this... but I didn't know about that DUMPEL tool and it definitely sounds useful. –  Richard Beier Jun 3 '09 at 17:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.