Event Log on D: vs. chkdsk with dismount of volume D:

[No Never]

Hello,

I've "echo Y | chkdsk D: /f /x" to check the D: drive with checkdisk.
Also I want to have my Application Event Log on D:
But both does not work together.
Option /x of chkdsk dismounts the volume that /f can have allways success.
But this leads to a corrupt event log file which I can't "restore" or
"reopen".
Is there a possibility to disable the application event log before chkdsk /f
/x
and enable it afterwards ?
Are there other possibilities to check D: and have the event log there ?

Many thanks, Wolfgang

 

[Guest]

This article shows how to change the log file locations.

http://support.microsoft.com/default.aspx?scid=kb;en-us;216169

Maybe it will get you started in the right direction that you want to go.

 

[No Never]

Hello Joe,

Thanks for your link. But my App. Event Log -File allready resides on D:
I've no trouble with it alone.
It's only the combination when I switch on chkdsk /f /x
then the EventLog gets corrupted.

Any other hints ? Thx, Wolfgang

 

[KM]

Wolfgang,

Perhaps you want to stop the Eventlog service just before you are launching the chkdsk. Then you can start the service again.
You can use net start/stop commands to accomplish that.

Although it may be required to launch the net command under LocalSystem account. Then schedule it with at command (/interactive
switch).

 

[No Never]

Hello KM,

This seems to be exactly what I was searching for.
Unfortunately it seems that eventlog does not support the stop command:
Try:
C:\WINDOWS\system32>NET STOP EVENTLOG
And you get an error message ...
(If you don't get one type NET HELPMSG 2191 to see mine)

But there must be alot of people out there successfully using eventlog on a
nonprotected volume,
which they want to "checkdsk" ?!

Any hints welcome, Wolfgang

 

[KM]

Wolfgang,

Sorry for late response. Has been on the road last week.

Well.. Seems like there is no "easy" way to stop the eventlog service (one of the reasons probably is that the service is required
and used through API by many other apps).

How about to schedule the chkdsk on that volume at next device boot? Then you shouldn't have any problems the chkdsk conflicting
with Eventlog accessing the volume.

 

[No Never]

Hello KM,

Well.. Seems like there is no "easy" way to stop the eventlog service

Thanks for confirmation.

How about to schedule the chkdsk on that volume at next device boot? Then
you shouldn't have any problems the chkdsk conflicting with Eventlog
accessing the volume.

Yes, thats also my guess now. But up to now I've only a possibility to set a
registry entry to do the test on startup
(http://support.microsoft.com/kb/q218461/), which is always
cleared after boot. Hence I must re-set the registry entry after every boot
or use EWF that it's stay's on each startup.
I'll have a try with this solution and hope that it does not conflict with
eventlog.

Thanks, Wolfgang