| Previous | Next |
| ERROR_EVENTLOG_FILE_CORRUPT | ERROR_LOG_FILE_FULL |
ERROR_EVENTLOG_CANT_START
The event logging service could not initialize its log storage.
ERROR_EVENTLOG_CANT_START is Win32 error 1501 (0x5DD). The failure is broader than a single application being unable to write an event: the event logging service could not open the files it needs during startup. Permissions, missing directories, corruption, storage availability, or configuration can all be involved. Because other services depend on Event Log, this condition can remove important diagnostics at the same time they are most needed.
Likely causes
- the event-log directory or configured channel path is missing or inaccessible
- the service account no longer has required access to one or more log files
- critical log files are corrupt, locked, or located on unavailable storage
- a registry or channel configuration points to an invalid path or size
- filesystem, encryption, filter-driver, or security software blocks service startup
Alternative evidence sources
Capture Service Control Manager status and exit codes, boot diagnostics, filesystem and filter-driver events available from other channels or recovery tools, configured log paths, ACLs, free space, and recent policy or security changes. Since normal event logging may be unavailable, preserve console output, service traces, setup logs, and offline registry information.
Investigation order
Check the Event Log service configuration and dependencies without repeatedly forcing restarts. Verify that %SystemRoot%\System32\winevt\Logs or custom channel locations exist on an online volume and have appropriate ownership and access. Inspect whether one damaged file prevents initialization or whether all storage access fails.
Use supported administrative tools from a recovery or maintenance context when necessary. Compare ACLs and channel configuration with a known baseline for the same operating-system version, but do not copy arbitrary log files from another computer. Investigate recent hardening, antivirus, backup, and filesystem-filter changes that may hold or deny the files.
Restoration steps
Preserve damaged files needed for analysis, correct path or permission problems, repair the underlying volume, and recreate only the affected logs through supported procedures. After the service starts, verify that new events can be written and read and that dependent services recover. Add monitoring outside Event Log for this specific service-start failure, because an Event Log alert cannot be relied on when the service itself is down.
Difference from one corrupt channel
ERROR_EVENTLOG_FILE_CORRUPT can describe an individual log file. Error 1501 describes startup failure because no event log file could be opened. Fixing one channel is not sufficient unless service initialization and basic read/write tests also succeed.
Example
A security baseline changes ACL inheritance on the event-log directory. After reboot, Event Log cannot open its files and the service returns 1501. Restoring the documented permissions and restarting the service recovers logging; deleting every log would have destroyed evidence without addressing the access problem.
References
- Microsoft: System Error Codes (1300–1699)
- Microsoft: Windows Event Log
- Microsoft: Windows Event Log tools
Looking for a different code? Search another status or error code.