Home | Site Map | Cisco How To |  Net How To | Wireless | Case Studies | Forums | Services | Donations | Careers | About Us | Contact Us|


Why bother deciphering Event logs when GFI EventsManager can do everything for you?
Free trial here!
Web ChicagoTech

 

Event Viewer display no information

 

Symptom: One of our servers is running Windows 2000 server with SP4. If I open Event Viewer, click Application or System, there is not information on the left panel. It is empty. These are what I did.

 

  1. If I press F5 in System to refresh, the System Events display. However, that doesn’t work in Application Event.
  2. The AppEvent.evt is located in c:\winnt\system32\config. The size is 1023KB and the date is 7/28/2004 (it 6 months old).
  3. If I go to the properties of the Application event>Filter, all event type are checked. The problem is the both From and To are current date and time, for example 3/9/2005, 3.20.03 PM. They are gray out and can’t be changed. However, If I switch From/To to Event On, I may be able to change the date and time. But that doesn’t any changes. Just not information display.
  4. If I try to Restore Default, The Filter will come back and both From and To are the same date and time.
Resolutions: 1. To fix this problem, you may want to delete the *.evt files. To do this, you should stop the Event Log Service by following these steps:

 right-click My Computer>Manager>Services and Applications>Services>Event Log Service>General, set the "Startup Type:" to "Disabled" restart the computer, then delete or rename the corrupt *.evt file(s) from %systemroot%\system32\config then set the Event Log Service "Startup Type:" back to "Automatic", restart the service.

2. Install a hotfix based on this article Event logs are corrupted.

Relate Topics

How to obtain a hotfix from Microsoft.

 

 

  This web is provided "AS IS" with no warranties.
Copyright © 2002-2008 ChicagoTech.net, All rights reserved. Unauthorized reproduction forbidden.