Event log service is unavailable issue

Listen with webReader
Published 21 December 08 01:50 PM | Johan Hedberg

I thought I'd blog about this issue I had, since it was in the end so easy to solve, but I had a hard time finding a good description of both my specific problem and any resolution. I am a bit ashamed to say that I got quite creative before trying this.

The problem I was having was that when opening the Event Viewer on my Windows Server 2008 I'd got a message saying that "The Event Log service is unavailable. Verify the service is running.". And if I went to look it was in fact not running. The thing is though that I could easily start it, and it would keep running, until I went to the Event Viewer to look at the logs, which would then bring it down.

I solved this by simply deleting all the files in the C:\Windows\System32\winevt\Logs folder.

Update 2010-02-22: Feedback in comments suggest that you might need to restart after performing this step.  

I'm not going to patent the solution, or make the claim that it will work in every case, but it did for me, and if you are experiencing this problem it's easy enough to try.


# cashdeveloper domainparkingblog said on November 22, 2009 12:12 AM:

Just found this.  I keep having problems with this so will try your solution. Although I have full admin rights I keep getting an error sauying  access to windows event log is rquired and I don't have permission. yet I have full permissoins on my account

# Scott said on December 16, 2009 11:01 AM:

Genius, well done!

# mtdrew said on February 22, 2010 03:32 AM:

Tried the following from other forums/blogs/etc:

1. Elevated CMD->"netsh winsock reset"(has solved service failures in the past).

2. Verification of permissions on directories and registry entries relating to the Event Log Service.

3. Elevated CMD->"sfc /scannow" System File Checker tool.

But nothing was working until I tried your solution and it works for me! Might want to edit your post to say that a restart after the files are deleted is recommended since I had to before it would start correctly.

Thanks again!


# Johan Hedberg said on February 22, 2010 08:15 AM:

Thanks. As I recall, I deleted the files with the service stopped and when I started it it worked fine. But I'll update the post as restarting wont hurt and it might behave differently for different installations.

# Korey O. said on August 23, 2010 04:36 PM:

You guys freaking rock. Thank you for posting this!

# Mark Poole said on October 28, 2010 08:00 PM:

That is a killer fix! I made sure the service was stopped, deleted the files, and started the service. Event Viewer opened right up!

Thanks for a great post!!!

# Hanu said on January 6, 2011 03:22 PM:

Excellent... Thanks for your solution

# Tobias said on May 10, 2011 09:10 PM:

:( Nope. Didn't work for me. Will keep searching.

# Julius said on June 11, 2011 10:20 AM:

This works like a charm dude!!!!!! I was able to resolve it with no issue. I obviously tok a backup of the files first(lest something goes wrong......as the case is always with me;-))

# Nijesh said on July 16, 2011 12:48 AM:

Didn't work for me. Will keep searching :(

# Shashi said on September 22, 2011 02:36 PM:

Same here Did not work. There is not logs folder in winevt folder.

# Ray said on October 21, 2011 09:38 PM:

Thanks guys, I spent two days for fishing right solution, and then I found you!

Little extension to your fix: after deletion Logs folder, create new Logs folder, because my Windows said he couldn't find the path.

# Racs said on November 18, 2011 05:00 AM:

No, it didn't work. Ouch.

# Gopichandra Yadav said on February 14, 2012 10:57 AM:

Thanks a lot. it works..

# Davius said on June 6, 2012 04:14 PM:

So Simple, yet a great fix! Thank you so much for this, I tried many more complicated fixes, and this the one that worked.

# Estevan said on August 10, 2012 10:47 PM:

this does work it was such a relief when this was fixed on my server. thanks

This Blog



    Twitter Updates

      Follow me on twitter


      Feedburner Subscribers

      Locations of visitors to this page


      All material is provided AS IS voiding any thinkable or unthinkable effect it might have for any use whatsoever. There... is that clear enough ;)