Event log problem

[dontread]

I have an Exchange server that runs 24x7 and it has stopped processing
System events but the Application and Security logs are still updating.
I applied the 2000 Post service pack 4 roll-up on Feb 15th and that is
the last entry for system events. Whats weird is I can use the net send
command from a remote system to generate System events on the Exchange
server but nothing seems to be happening from the server itself. This
is happening to all four Exchange servers including both virtual
servers. Even the Exchange monitoring alerts have stopped updating the
System events on all the servers. Unfortunetally we are running the
clusters in Active/active mode so I can't reboot until the maintenance
window.

Does anyone know how to generate additional system events? I stopped
and restarted as many services as I could.

 

[Dave Patrick]

The temporary fix;
You might try changing the file properties to "Overwrite as needed"

Then; Control Panel|Administrative Tools|Services|Event Log Service|General,
set the "Startup Type:" to "Disabled" restart the pc, then delete (or move)
the corrupt *.evt file(s) from %systemroot%\system32\config then set the
Event Log Service "Startup Type:" back to "Automatic", restart for effect.

The more permanent fix;
http://support.microsoft.com/default.aspx?scid=kb;en-us;829246&Product=win2000

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

|I have an Exchange server that runs 24x7 and it has stopped processing
| System events but the Application and Security logs are still updating.
| I applied the 2000 Post service pack 4 roll-up on Feb 15th and that is
| the last entry for system events. Whats weird is I can use the net send
| command from a remote system to generate System events on the Exchange
| server but nothing seems to be happening from the server itself. This
| is happening to all four Exchange servers including both virtual
| servers. Even the Exchange monitoring alerts have stopped updating the
| System events on all the servers. Unfortunetally we are running the
| clusters in Active/active mode so I can't reboot until the maintenance
| window.
|
| Does anyone know how to generate additional system events? I stopped
| and restarted as many services as I could.
|