3

Last week our Application Log appeared to be corrupt. Event Viewer said the log was 20MB, and had 18,446,744,073,709,550,735 (0.000000000008674 bits each) records (which can not possibly be true), and mmc would crash whenever we tried to view the log.

We cleared the Application log, and it appears to be logging data because when we go to the Windows Logs section in mmc, it says the Application Log has 1,985 events (in 3MB), but when we actually click on the log to open it, it says there are zero events.

I have made sure that all filtering is off. Any ideas?

Edit: Problem appears not to be an isolated incident. See Application Event Log keeps getting corrupted.

2 Answers 2

3

Based on Shane Madden's answer but with no restart required... (This is an e-commerce production server, so we can't restart easily.)

  1. In Event Viewer, right click the Application Log.
  2. Change the name of the log. I added _2 at the end.
3
  • Nice! Make sure to accept this answer for people who find this question in the future with the same issue; I believe it'll let you do so once the question is 8 hours old. Jan 9, 2012 at 22:31
  • Two days until I can accept it...
    – yakatz
    Jan 9, 2012 at 22:38
  • Ahh - 200 rep might be the threshold for the faster accept, then. Though I can't find the documentation on that at the moment.. Jan 9, 2012 at 22:41
2

2^64 is near the number that you're seeing. Coincidence? I think not!

Sounds like the log's definitely corrupt; your best bet may be to just nuke it (see here) and start clean.

3
  • That KB article does not apply to Server 2008 R2. The files mentioned do not exist. I have been looking for a similar article for Server 2008 R2, but I have not found one.
    – yakatz
    Jan 9, 2012 at 21:07
  • Right you are - try C:\windows\system32\winevt\logs\application.evtx Jan 9, 2012 at 21:09
  • Right direction, see my answer below.
    – yakatz
    Jan 9, 2012 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .