Event Viewer

[Keith]

When I go into event viewer it shows the events in the
system log. It says there are about 2,000 events
When I select application log it states at the top that
there are 1,900 events but nothing shows up in the screen
then if i go back to the system log I no longer see any
events and the number of events at the top changes to 0.
I tried to access the events of this 2000 server from
another machine and I get the same result.

 

[Sum]

Could it be that the maximum size of log file has been reached ?

 

[nat]

No - events are set to overwrite. I am getting EXACTLY
the same as keith with the system log displaying fine,
then the application log showing over 2000 items but not
displaying any events. going back to the system log
shows ) again until I refresh the view. I exported the
application log and then connected to it and was able to
see the events listed but am still unable to view the
properties as per Ken's posting. Again, I can find
nothing on Technet.
I have W2K SP4 with all latest critical updates but this
was happening in SP3 before upgrade.
HELP!

 

[Charles Otstot]

I have seen some previous postings regarding similar issues. The responses
(ableit *none* from Microsoft) indicated that the following is a
post-Service Pack problem with Windows 2000:

Security and System logs appear normally.
Selecting the Application log results in:
1) Events are NOT visible in the Application Log. Clicking in the log
highlights what are (apparently) entries in the log, but
no detail is visible. Double-clicking does NOT bring up the detail
message box for an event.
2) The System and Security log entries are no longer visible after
attempting to view the Application log.
3) If the Event Log is saved and cleared, the saved log is not viewable and
attempting to open it renders all logs
unviewable.
4) Exiting the Event viewer and reopening allows viewing of the Security and
System logs *until* one attempts to view the
Application log. Once the application log is opened, results 1) and 2)
are repeated.
5) Clearing the event logs and rebooting refreshes all three logs for an
indefinite period. This resolves the immediate
problem, but does not prevent a recurrence.

We have seen these issues on two different post-SP4 boxes. We have not
tested deleting and rebuilding the event logs (MS has a KB article for
deleting the logs using Safe Mode startup. I feel confident that deleting
and rebuilding would only be a temporary correction and NOT a permanent fix.

Anybody from Microsoft have any hard information regarding these issues and
whether MS has it/them listed as a known issue? If so, is there any
information on an expected *resolution* date?

 

[dcdon]

I'm not so blessed, but I have rebuilt the files, helped about 100 more do it.
Ad so far, haven't had any complaints.

If you would like for me to share, I do so gladly.

Go to
Services stop and disable Event log (right click MyComputer > d/c Management > d/c Services >
right pane d/c Services > d/c Event log > change to disabled > OK out

Do a search for *.evt, and delete sysevent.evt, secevent.evt, and appevent.evt
or add.old to the end, if you are not so sure about deleting.

They are located %SystemRoot%\Winnt\System32\config\<file>.evt

Reboot and the new files will be generated.

If you renamed instead of deleting, search for *.old and nukem.

Go back to Services and restart Event log and set to Automatic.

You should be good to go.

There have been too many with this problem for it to be a coincidence. It's an
infection, hack, or one of the hotpatches causing it.



good computing,
don
------------



I have seen some previous postings regarding similar issues. The responses
(ableit *none* from Microsoft) indicated that the following is a
post-Service Pack problem with Windows 2000:

Security and System logs appear normally.
Selecting the Application log results in:
1) Events are NOT visible in the Application Log. Clicking in the log
highlights what are (apparently) entries in the log, but
no detail is visible. Double-clicking does NOT bring up the detail
message box for an event.
2) The System and Security log entries are no longer visible after
attempting to view the Application log.
3) If the Event Log is saved and cleared, the saved log is not viewable and
attempting to open it renders all logs
unviewable.
4) Exiting the Event viewer and reopening allows viewing of the Security and
System logs *until* one attempts to view the
Application log. Once the application log is opened, results 1) and 2)
are repeated.
5) Clearing the event logs and rebooting refreshes all three logs for an
indefinite period. This resolves the immediate
problem, but does not prevent a recurrence.

We have seen these issues on two different post-SP4 boxes. We have not
tested deleting and rebuilding the event logs (MS has a KB article for
deleting the logs using Safe Mode startup. I feel confident that deleting
and rebuilding would only be a temporary correction and NOT a permanent fix.

Anybody from Microsoft have any hard information regarding these issues and
whether MS has it/them listed as a known issue? If so, is there any
information on an expected *resolution* date?

 

[Melissa]

Good day all. Don was kind enough to answer my post
and I did as he said. It did not work for me. I will be
opening a case with Microsoft today and will let you all
know what the solution is if any. Stay tuned....

-----Original Message-----
I'm not so blessed, but I have rebuilt the files, helped about 100 more do it.
Ad so far, haven't had any complaints.

If you would like for me to share, I do so gladly.

Go to
Services stop and disable Event log (right click

MyComputer > d/c Management > d/c Services >

 

[Guest]

I just talked to MS. I cannot do this until tonight but
wanted to post this. I explained what the issue was and
what has already been tried. He had me run a reporting
utility and send him the file. The he sent me these
instructions:

Hi Melissa
Here are the steps on how to get to the Recovery Console:

Starting the Recovery Console and renaming the .evt files
----------------------------------------------------------

1. Insert either your Windows 2000 CD-ROM or the first
Windows 2000
Setup boot disk into the proper drive, and then
restart your computer.

2. Press a key to start Windows 2000 Setup from your CD-
ROM, or follow
the instructions on the screen if you are using
Windows 2000 Setup boot
disks.

3. At the Welcome to Setup page, press R to repair a
Windows 2000
installation, and then press C to use the Recovery
Console.

4. In the Recovery Console, press the number key for the
Windows 2000
installation that you want to repair, and then press
ENTER. Note that
if you press ENTER without pressing a number, the
Recovery Console
quits, and your computer restarts.

5. When the Recovery Console prompts you for a valid
administrator
password, type your local system administrator
password, and then press ENTER.

6. This will take you to the <%SystemRoot%> directory. By
default it is usually C:\WINNT.

7. Once there, change the directory to the <%systemroot%

\system32\config directory and rename the following

files to .old :
a) AppEvent.Evt
b) SysEvent.Evt
c) SecEvent.Evt
Note: we use Ren command here to rename files.

8. After you have renamed the files, type 'exit' at the
command prompt to reboot the server and once it boots up,
the Event viewer should start logging events normally.

Let me know if you face any problems.
Thanks in Advance

Neeraj Kakoty, BIS
Microsoft Enterprise Support
Windows 2000 Server Setup and Performance Team

Good luck to all. I'll let you know how I make out.

-----Original Message-----
Good day all. Don was kind enough to answer my post
and I did as he said. It did not work for me. I will be
opening a case with Microsoft today and will let you all
know what the solution is if any. Stay tuned....

-----Original Message-----
I'm not so blessed, but I have rebuilt the files,

helped
about 100 more do it.

Ad so far, haven't had any complaints.

If you would like for me to share, I do so gladly.

Go to
Services stop and disable Event log (right click

MyComputer > d/c Management > d/c Services >

right pane d/c Services > d/c Event log > change to disabled > OK out

Do a search for *.evt, and delete sysevent.evt, secevent.evt, and appevent.evt
or add.old to the end, if you are not so sure about deleting.

They are located %SystemRoot%\Winnt\System32

Reboot and the new files will be generated.

If you renamed instead of deleting, search for *.old

and

 

[dcdon]

You are the first person that has reported that it did not work to build new sysevent.evt,
secevent, & appevent.evt
1.) Disable Event log in Services
2.) Delete appevent.evt, sysevevn.evt, & secevent.sys
(They are located %SystemRoot%\WINNT\System32\config\<file>.evt)
3.)Reboot
4.)Set Event log in Services to Automatic
5.) Reboot
6.)Check Event Viewer for all three logs
That should work unless you have others troubles such as virus, worm, backorifice,
trojanhorse, other corrupted area.

The next thing I suggest is to go to a command prompt to do this
SFC /SCANNOW & CHKDSK /R/F

The next thing I suggest is to do a repair of W2K

1.)Change BIOS 1st boot device to CD
2.)Insert CD into tray.
3.)Restart booting with CD
4.)Choose to Install
5.)When prompted choose "Repair"

If that doesn't get it, get ready to format and clean install
Backup all data, favorites, addressbook, fonts, media, internet dialup settings, internet
broad band settings, write down drivers intalled now in device manager, preferences in apps,
..ini files from IRC, look for any other data files, or setting files.

To wipe the drive some ways include; boot a win98 startup disk, run fdisk and
delete all partition information found (as long as NTFS is primary). Or boot
the Windows 2000 CD-Rom or setup disks and when you get to the point, delete
the existing NTFS and or other partitions found, then abort the install. Or use
a utility named delpart. Then boot the Win98 CD-Rom to start your install.
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt31/i386/reskit.exe

**BEFORE STARTING**
======================
Print or save instructions. Read through a couple times. If something is unclear, please ask
someone that knows. Make notes concerning internet connections, other instructions needed
(such as how to import and export favorites and address books). Make note as you go, so that
when you get ready to do a clean install again, you can refresh your memory. When asking
questions, please learn and use proper information to receive the help you need. Keep all data
and software free of dust and any foodstuffs. You may not need all of these instructionsk
tools, or materials,but it's difficult to outguess teh knowledge and skill level that fits
everyone.





**PREPARATION SECTION**
======================
TO BEGIN:
-RULE -If it ain't broke, don't fixit.
-RULE -Spiral pad, good notes, date, set time to work.
-RULE -No interruptions.
-RULE -Suspend all rules for spouse.

BE PREPARED) (a good mood)
-Gather all of your software, including the "key" numbers
-Get current drivers for all Hardware (incl. Bios for MoBo)
-Get all tools (include static strap, flashlight, magnifying glass,compressed air, soft
eraser, etc.)
-Get all materials (Screw Drivers, pliers, electrical tape,

From Experience the Hard Way. (Not learning enough from others wisdom, and not being fully
prepared before starting)
*REMOVE - ALL data, Favorites, Bookmarks, Address book, mIRC ini files, images,
ToDoLists, Music, DVD's, fonts, Media, etc.
*Always make sure you are static equal. (wear protection[static strap], or touch PSupply
case with power OFF, but plugged in)(before working in the box)


NOTE: Don't need a course to complete a clean install, but to keep your frustration level
down, it's worth lining your ducks up in a row before beginning.
To help, you might just want to start by doing the following:
-Print Instructions, and follow them. (Or use Murphy's Law)
-Print or Write out Hardware list. (MoBo, CPU, RAM, HDD, Floppy, CD-ROM, Video, Audio,
Modem, LAN, etc.)
-Allow 30 minutes quiet time after each time you work to recover.
======================





**FDISK SECTION**
======================
TO FDISK OR NOT:
-New HDD - YES
-Basic Partition - YES
-OS Upgrade - Usually
-regular FORMAT: NOT necessary
-Required Min. HDD Space -(10gig W2KSP4+IE6+OE6)(2gig NTSP6)(500meg ME,98se,98fe)(300meg
95b,95,3.11)
*Note - Double minimum HHD space, if a separate partition is used for OS and applications.
===========
===========
FDISK Tips: Option 4 looks at present partitions, press Esc.; Option 3 "only" to delete
partitions.
Delete order - NON-DOS,Logical,Extended, and finally Primary; use Exc. to exit.
Option 1 - Create Basic partition for OS and data on one drive.
Option 1 - Create ONE Primary partition for two or more partitions.(multiple Primaries
needed only to add Linux, etc.)
===========
===========
How to FDISK:
-Boot system with 98se Bootdisk (www.Bootdisk.com)
-At A:\ prompt type FDISK, enter.
-Choose "Y" for "large disk" for 95b,98se,ME,NT4,W2K,XP (enables FAT32)
-Use "Basic" for a single partition (Primary Active partition)
-Set Primary active to "adequate size" (Logical, and extended can be resized)
-Press "Esc."
-Power down with switch.
{Note: You run FDISK, just to look, like first time, "without changes", with no adverse
effect; use Esc. to exit}
(There four choices in FDISK; you can take a look at them w/o fear of screwing up. Just don't
delete anything)
===========
===========

FRESH INSTALL is BEST, if "DATA" NOT NEEDED.
-ERASES EVERYTHING- (within DOD standards)

*You probably don't need to FDISK, unless the current HDD has "multiple" partitions.
*If it does, Boot from 98se bootdisk, type FDISK, press ENTER, use Basic partition (one
partition only for everything).
*Shutdown the power.

To erase the HDD, you Format the HDD.
======================






**Format Section**
======================

Format the Hard Disk:

*You can use your hard disk only after FORMAT. -->(New HDD or after FDISK)

Format as follows:

1. Boot computer into WS-DOS using your Boot Disk. (www.bootdisk.com)

2. At the "A" prompt (A:\) type the following:

format c: /u /c /s (assume "c:\" <drive letter>)

Command Legend:
/u= Unconditional Format - ignores deleted cluster fragments
/c= Re-tests currently marked bad clusters for recovery
/s= Transfers necessary system files so disk can boot


3. Type "Y" for yes, press Enter to proceed with format.

4. Once format is complete, type a volume label if you want one and press ENTER.

===========
===========
How to Install 98se
http://www.basichardware.com/how_tos.html
===========
How to Install Win-ME
http://www.windowsreinstall.com/indexwinme.htm
===========
How to install W2K
http://www.techtv.com/screensavers/answerstips/jump/0,24331,3346825,00.html
===========
If you have any problems
http://support.microsoft.com/default.aspx?scid=kb;EN-US;277552
===========
===========
Fresh Install W2K

**Note: For a Clean Install of W2K w/SP4, IE6 w/OE6, and a normal amount of applications on
one partition, allow "10 gig" min. for your OS partition, unless you intend to
make it a "basic" partition.

To remove/change partitioning use a Win98 boot disk in Command Prompt:
type "FDISK" ...and remove all partitions
Shutdown Power(turn computer OFF)


Fresh install w/o changing or after setting the partitions:
Boot with Win2000 or XP Boot disks into Command Prompt:

"type" format c: /u /c /s -->follow prompts


Command Legend:
/u= Unconditional Format - ignores deleted cluster fragments
/c= Re-tests currently marked bad clusters for recovery
/s= Transfers necessary system files so disk can boot


Restart with Win2000/XP startup disks and it will walk you through the install.

Incomplete as it's going to be.
Under this is another little outline to help with installation.
You might want to read through it.



Note: Extra material for after install
Setting Group Policy to Complex Password Requirements
http://support.microsoft.com/default.aspx?scid=kb;en-us;225230&Product=win2000

If it is not mentioned prior it is manditory to do the following:
Install a AVP and use it correctly
Install a firewall (hardware or software) and use it correctly
Install Privacy ware (i.e. Ad-aware) and use it correctly
Install anti-malware (i.e. SpyBot-S&D) and use it correctly

Also suggest the on Clean Install after OS installed, Drivers Updated, Windows Udate
performed, and I.E&O.E. installed, Make a Ghost or Disk Image ISO to make the Clean Install
process take far less time. Save a copy on HDD, and one to an external storage source.

Install all applications and update each at the appropriate sites.

I hope this has given some light to the replacement of the files into working order.
Namely appevent.sys, secevent.evt, & sysevent.sys


good computing,
don
=-=-=-=-=-=-=-=--=-





Good day all. Don was kind enough to answer my post
and I did as he said. It did not work for me. I will be
opening a case with Microsoft today and will let you all
know what the solution is if any. Stay tuned....

-----Original Message-----
I'm not so blessed, but I have rebuilt the files, helped about 100 more do it.
Ad so far, haven't had any complaints.

If you would like for me to share, I do so gladly.

Go to
Services stop and disable Event log (right click

MyComputer > d/c Management > d/c Services >

 

[Charles Otstot]

I just talked to MS. I cannot do this until tonight but
wanted to post this. I explained what the issue was and
what has already been tried. He had me run a reporting
utility and send him the file. The he sent me these
instructions:

Hi Melissa
Here are the steps on how to get to the Recovery Console:

<snip>

Based on this, it looks like MS Support doesn't been given a clear handle on
the underlying issue yet.

Melissa, the procedure MS Support gave you is the same as the info Don gave
you, with one exception.
They had you going through the Recovery Console in a fashion which is
equivalent to opening in Safe Mode, Command Prompt Only. This keeps the
Event Log service from starting and you can delete the .evt files.

Don's instructions didn't include a reboot prior to deleting the files. I
haven't tested with my systems, but it sounds like you may not have been
able to delete the .evt files after setting the service to disabled. This
would be because the Event Log Service was still running (you cannot stop
the service). Rebooting would have prevented the service from starting, thus
the .evt files would not be in use and could be deleted.

MS has a KB Article on deleting and recreating corrupt event logs files. The
article is KB172156
(http://support.microsoft.com/default.aspx?scid=kb;en-us;172156&Product=win2
000). Note that the indicated KB article does not make use of the Recovery
Console, but a general subset of Don's procedure.

In any event, while either procedure will remove the corrupted event logs
and will replace them with (ostensibly) clean log files, I would not be
confident that the condition leading to the initial corruption no longer
exists. Assuming the install *process* of SP4 caused the corruption, I would
have expected the event logs to have become immediately unreadable. I will
allow *some* possibility that the install process caused minor corruption
preventing the event log from overwriting events, eventually filling the log
and exhibiting the symptoms. In this scenario, a clean rebuild of the files
would be a permanent fix, but I would want confirmation from MS that this
*was* the underlying cause before I would declare the box fixed. The other
possibility allowing this to be a permanent fix would be a change to the
event viewer executable accompanying SP4 that is incompatible with pre-SP4
event logs, causing corruption in some cases.
In any event, I would like to hear a definitive cause from MS (be it through
the groups or in a KB article) before I consider the issues closed.

 

[Melissa]

Let me start by saying the problem was fixed. The
recovery console did not work, I could not log in. It is
a DC was working on so there is no local admin account.
Our Domain admin account is renamed. So even though I
entered our domain admin password I suspect because the
account name isn't Administrator it would not let me in.

I retried the steps "DCDON" gave with disabling Event
service, deleting and restarting and this time it
worked. Don't know why it didn't work the first time but
sure glad it worked the second time!

Thanks to all!

-----Original Message-----
I just talked to MS. I cannot do this until tonight but
wanted to post this. I explained what the issue was and
what has already been tried. He had me run a reporting
utility and send him the file. The he sent me these
instructions:

Hi Melissa
Here are the steps on how to get to the Recovery Console:

Starting the Recovery Console and renaming the .evt files
--------------------------------------------------------- -

1. Insert either your Windows 2000 CD-ROM or the first
Windows 2000
Setup boot disk into the proper drive, and then
restart your computer.

2. Press a key to start Windows 2000 Setup from your CD-
ROM, or follow
the instructions on the screen if you are using
Windows 2000 Setup boot
disks.

3. At the Welcome to Setup page, press R to repair a
Windows 2000
installation, and then press C to use the Recovery
Console.

4. In the Recovery Console, press the number key for the
Windows 2000
installation that you want to repair, and then press
ENTER. Note that
if you press ENTER without pressing a number, the
Recovery Console
quits, and your computer restarts.

5. When the Recovery Console prompts you for a valid
administrator
password, type your local system administrator
password, and then press ENTER.

6. This will take you to the <%SystemRoot%> directory. By
default it is usually C:\WINNT.

7. Once there, change the directory to the <%systemroot%

\system32\config directory and rename the following

files to .old :
a) AppEvent.Evt
b) SysEvent.Evt
c) SecEvent.Evt
Note: we use Ren command here to rename files.

8. After you have renamed the files, type 'exit' at the
command prompt to reboot the server and once it boots up,
the Event viewer should start logging events normally.

Let me know if you face any problems.
Thanks in Advance

Neeraj Kakoty, BIS
Microsoft Enterprise Support
Windows 2000 Server Setup and Performance Team

Good luck to all. I'll let you know how I make out.

 

[Melissa]

Yes I agree with your take on Microsoft. Yes I know you
can't stop the Event service and yes I did reboot with
the service disabled and successfully deleted the event
logs. I then set event log back to automatic and
rebooted. I could see they were new log files however the
problem was still there. I explained all this to
Microsoft, argued that what they are having me do is
essentially what I had alreay done except they wanted the
files renamed rather than deleted. I'm sure you know how
tech support is. I knew he hadn't a clue and I kept
telling him there are a lot of people out there having
this same problem. Which is why I'm guessing he had me
run a util and collected all kinds of data from my
machine for examination. I think they know there is a
problem and are still trying to find the source. As you
will see in my post above, Recovery Console did not let
me log in. I suspect because my built in Administrator
account is renamed and there is a dummy Administrator
account out there. Ultimately doing the steps with the
Event service itself again worked this time.

Thank you for taking the time to respond.