NTSTATUS 0xC000018E (STATUS_EVENTLOG_FILE

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: An Event Log file failed structural validation and cannot be treated as a normal readable log.

Previous	Next
STATUS_TRUSTED_RELATIONSHIP_FAILURE	STATUS_EVENTLOG_CANT_START

STATUS_EVENTLOG_FILE_CORRUPT

The Event Log file is structurally corrupt

Windows Event Log supports live channels and backup log files. This status indicates corruption of the log file itself, not a missing provider message DLL or a malformed XPath query. Continuing to parse the same file as if only one event were bad can hide damage to record or file metadata.

Preserve a copy of the affected .evtx before clearing or replacing anything. Record whether the failure occurs through a live channel or EvtOpenLog on a backup file. Storage errors, abrupt interruption, and unsupported manipulation of the file should be investigated separately from publisher metadata problems.

What to inspect

Copy the affected log and record its path, size, and filesystem timestamps.
Test whether other channels open and whether the failure is limited to one backup file.
Export recoverable events before clearing a live channel or replacing the file.

References

Looking for a different code? Search another status or error code.