Event Viewer not working correctly

[rob davis]

Lately, on all of my win2k servers, i am unable to view
events in the event viewer...for example in Application
log, at the top of the screen it displays Application log
1060 event(s)

but no events are there......

I have the latest service packs and this is happening on
all of my servers in all logs.....


thanks

rob davis

 

[Bennie Chen]

Hi Rob,

Thank you for posting!

If possible, can you provide a screen shot for the event viewer? This
behavior seems quite interesting.

Here is one thing you can try:

Open Event Viewer. Press and hold on the left CTRL key and then press the +
key in the number pad. Does anything change?

If we use the mouse curser to re-size the columns, we may be able to hide
all columns. If so, the suggestion above (CTRL and +) helps.

Thank you!

Regards,
Bennie Chen
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Joel Parlin]

The same thing happened to me. In my case it was a post
SP4 hot fix that caused the problem. I still haven't
found a solution to the problem. Security and system will
show if I click on the refresh tab. As for the
application tab, nothing. I have seen this problem a few
times on TechNet, but nobody seems to know how to fix it.
It seems to be a common thing, so I suppose MS will
eventually issue a fix for it.

 

[rob davis]

Ok, I checked the event viewer this morning and everything
seems to be working fine....If it does happen again, i
will post a screen shot to this newsgroup.

thank you for your quick response......

 

[Ed Astle]

I kept a copy of AppEvent.evt that reproduces this problem on my box. It's
512KB - I'll email it to you if you really want it.
Loading it up clobers the viewer (it thinks all logs now have 0 entries) - I
have to quit and restart event viewer to look at my current logs again.

I tried your "Left Ctrl +" while the focus was in the log window and all the
columns shrunk so much they no longer displayed the column headings.

Regards,
Ed

 

[rob davis]

Oops.....it's happening again......if i keep hitting
refresh the events appear after awhile.... very wierd.....
it happens more with the System event log.......

 

[rob davis]

If the evt files are corrupt, then it would not work at
all would it?.........

I did do the whoami, and i am logged in as Administrator

how do you rebuild these files?

thanks

 

[Bennie Chen]

Hi Rob,

We can use the following steps to rebuild the .evt files.

1. Click Start>Run. Type SERVICES.MSC and click OK.

2. Select the EventLog service and click Startup. Change the Startup Type
to Disabled, and then click OK.

3. Restart Windows.

NOTE: When the system starts up, several services may fail; a message
informing the user to use Event Viewer to review errors may appear.

4. Rename or move the *.evt files from the following location:

%SystemRoot%\System32\Config

5. Run SERVICES.MSC and re-enable the EventLog service by setting it back
to the default of Automatic startup. Then reboot.

Hope this helps. Thank you!

Regards,
Bennie Chen
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Gordon Cunningham]

I'm seeing similar issues, but this didn't fix it, nor did
resetting all the logs back to default settings. Any more
ideas? I can read the event item properties form another
machine on the network, just not locally!

- Gordon

 

[Bennie Chen [MSFT]]

Hi Gordon,

Thank you for your post!

Does this occur even when there is only a few entries in the event log? In
addition, you can view the logs normally from other computers, right?

According to my experience, similar issues can occur if the log files are
corrupted or there are too many entries so that the system does not have
enough resource to display them.

If recreating logs do not resolve the issue, you can boot the system into
Safe Mode to see if these logs are displayed. You can also use a 3rd party
tool named Process Exporer to see if there is any 3rd party DLLs that are
attached to the MMC process.

The tool can be downloaded at the following link.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Run the procexp.exe program. In the Process list, select MMC.exe. In the
menu, click View, then select View DLLs. Check these DLLs to see if there
is any strange one.

By the way, please also check if there is any virus on the system.

Hope this helps. Thank you!

Regards,
Bennie Chen
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.