Printable View
Somehow my security event log has become corrupted and I cannot gain access to the previous file. Nor log anything current events. It states it was last modified a couple days ago and it seems I cannot even save the current log. Any suggestions on how to recover the previous log and get it to start logging again?
Have you tried to just clear the eventlog? It's no use to you now anyway.
Is there enough diskspace available?
Which version of Windows are you working on?
Windows NT, but for reasons. I would really like to try to restore what was corrupted and understand how or why this had happend so I can avoid the possibility of this happening in the future.
have you tried exporting the logs to a .csv file ?
if not then try it, but it does sound like they are just full and need purging !
Not enough information really but i would try and export them into .csv nad see what happens .
maybe this is of no help at all though, as i said need more information.
the save as feature is disabled.
You have to help us help you.
We need to know:
1) Are you logged in as the local administrator?
2) What events happened just before this condition came up?
3) What version of NT? (workstation or server) and what service pack level (post 6a srp, etc.)?
4) What you see (screen shots are helpful)?
5) Do you remember what you had Event Viewer set for? (how big of a file, rotation, etc)?
If we have these things, we may be able to narrow down some options for you.
--TH13
im stuck then sorry, have you tried the knowledge base ?
http://support.microsoft.com/
Yes, I am logged on as the Local Administrator. Same errors occur under normal user account. Nothing happened before the condition, but when I open the event viewer it opens to system where everything is normal and once I click on the security tab I get the error "The event log file is corrupt" and in the section where it would say # of files it states "unable to read contents". I am running Windows 2000 / SP 2. I cannot get into the viewer settings, it seems System and Applications properties work fine, but when I right click on Security I get no properties option. I am confused. Never seen anything like this before.
Right OK you said earlier you were running Windows NT but you just said it was Windows 2000 SP2. Oh well never mind, on the knowledge base there is alot of info concering corrupt logs in event viewer so perhaps one of them applies to your scenario.
I know alot of security issues in Windows 2000 were caused by Scecli.dll which is updated to fix the issues in SP3 so maybe that will help.
try
http://support.microsoft.com/search/...fxSearch_Query
hoep this helps a bit
geepod has lead me to believe it could be: Microsoft Knowledge Base Article 811143 . Any other suggestions or if anyone disagrees with this possibility?
Regardless if this is related or not, you should keep your machine at least up to the latest service pack unless you are using 3rd party software which specifically states that it is not supported on a service pack higher than 2.
I think I'd update to SP3 before doing anything else. Also, is this an internet-facing machine?
yes DR watson is a common source of problems so that may fix the issue.
It should really be called Dr Lecter ! still hope you get it sorted
No this system is a stand alone machine.
Well like I said, start with service pack 3 and then roll forward from there. Chances are that you wont be able to recover from the corruption.