Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Last week our Application Log appeared to be corrupt. Event Viewer said the log was 20MB, and had 18,446,744,073,709,550,735 (0.000000000008674 bits each) records (which can not possibly be true), and mmc would crash whenever we tried to view the log.

We cleared the Application log, and it appears to be logging data because when we go to the Windows Logs section in mmc, it says the Application Log has 1,985 events (in 3MB), but when we actually click on the log to open it, it says there are zero events.

I have made sure that all filtering is off. Any ideas?

Edit: Problem appears not to be an isolated incident. See Application Event Log keeps getting corrupted.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Based on Shane Madden's answer but with no restart required... (This is an e-commerce production server, so we can't restart easily.)

  1. In Event Viewer, right click the Application Log.
  2. Change the name of the log. I added _2 at the end.
share|improve this answer
    
Nice! Make sure to accept this answer for people who find this question in the future with the same issue; I believe it'll let you do so once the question is 8 hours old. –  Shane Madden Jan 9 '12 at 22:31
    
Two days until I can accept it... –  yakatz Jan 9 '12 at 22:38
    
Ahh - 200 rep might be the threshold for the faster accept, then. Though I can't find the documentation on that at the moment.. –  Shane Madden Jan 9 '12 at 22:41

2^64 is near the number that you're seeing. Coincidence? I think not!

Sounds like the log's definitely corrupt; your best bet may be to just nuke it (see here) and start clean.

share|improve this answer
    
That KB article does not apply to Server 2008 R2. The files mentioned do not exist. I have been looking for a similar article for Server 2008 R2, but I have not found one. –  yakatz Jan 9 '12 at 21:07
    
Right you are - try C:\windows\system32\winevt\logs\application.evtx –  Shane Madden Jan 9 '12 at 21:09
    
Right direction, see my answer below. –  yakatz Jan 9 '12 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.