Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with server 2003 R2 that has shown signs of possible data loss. System event logs are missing a four month time chunk. Before today the last day in the logs is 2/12/2010 then it jumps to todays date 6/4/2010. Some people are saying data is missing from the server but recent backups suggest differently. This machine is using raid1 with an Intel Storage matrix controller. There are no apparent signs of hard driver failure, both drives show in bios and Intel Storage Matrix Console. If one drive is unplugged the system will not boot to server 2003; it doesn't matter which is unplugged. What is most interesting is the four month gap in all the logs and some programs. Online backup service shows daily backups, but backup app show last backup date as 2/12/2010 just like the system event logs. The machine is on 24/7 so i am not sure why it is saying this. Has anybody encountered an issue like this or can point me in a direction to investigate? Thanks

share|improve this question
were the logs sorted correctly :) – tony roth Jun 4 '10 at 20:17
yes the logs are sorted by date. – Mike D Jun 4 '10 at 20:21
check your flux capacitor must be running low – tony roth Jun 4 '10 at 20:26

This could be as simple as a setting change that didn't take place until recently. I don't see any mention of how your event logs are set up, but most admins I know opt to keep the logs at a fixed size, and have the newest data overwrite the oldest data in the log when that maximum size is reached. If for some reason you don't have that enabled, the log would fill to a fixed size and stop at that point; if you enable it sometime in the future (say, 4 months later, for whatever reason) the data rotation would begin in-place, with no entry to indicate that the log ran out of room in the past.

Another thought that just occured to me: it could be as simple as the event service was turned off or set to manual startup.

share|improve this answer
doesn't the truncation get logged – tony roth Jun 4 '10 at 21:24
No, it is silent. – Avery Payne Jun 4 '10 at 21:26
they are set with a max size (16MB) with overwrite as needed. I was looking on MS sites to determine if that means oldest first but have not found a concrete answer. The dates in the log go as far back as April 2009. – Mike D Jun 4 '10 at 21:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.