What does Windows error code 6641 (ERROR_LOG_CONTAINER_OPEN_FAILED) mean?

ERROR_LOG_CONTAINER_OPEN_FAILED

Log service encountered an error when attempting open a log container.

Windows assigns decimal 6641 and hexadecimal 0x000019F1 to ERROR_LOG_CONTAINER_OPEN_FAILED. The decisive subject is opening a CLFS container file or stream; the value alone does not reveal which object, server, file, session, or transition failed.

The native Value is 6641 (0x000019F1). Preserve this result immediately after the failing Windows call because later logging, cleanup, LDAP, RPC, or file operations can replace the last-error value.

Where the result appears

• opening a log after reboot.
• attaching an archived or restored log.
• enumerating containers for maintenance.
• creating a client context against an existing CLFS log.

State boundary to prove

This result applies to opening a CLFS container file or stream and does not by itself prove that the entire server, directory, disk, session, or application is unavailable. The state boundary to prove for this Win32 error is whether the container named by log metadata can be opened with the required access and sharing mode. Use resolved container path, desired access and sharing flags, and service token and effective ACL as independent evidence. When evidence for this Win32 error disagrees, preserve timestamps and investigate the transition instead of selecting the most convenient value.

Likely causes

• the container was moved, renamed, or deleted.
• ACLs no longer permit the service identity to open it.
• sharing or oplock state conflicts with the requested access.
• the volume or mount point is unavailable.
• base-log metadata references a container that was not restored.

Diagnostic sequence

1. capture error 6641 immediately at the API boundary and record the operation that was attempted.
2. identify the exact owner of opening a CLFS container file or stream, including object generation, server, path, session, replica, or client context.
3. collect resolved container path before restarting a service or changing configuration.
4. compare desired access and sharing flags with the documented or observed precondition.
5. correlate service token and effective ACL with the owning application log, CLFS-related System events, storage events, and any transaction or recovery trace.
6. determine whether side effects occurred and verify recovery after changing one responsible condition.

Evidence to collect

• resolved container path.
• desired access and sharing flags.
• service token and effective ACL.
• base-log container descriptor.
• the first CreateFile or file-system failure.

Correlate this result with the owning application log, CLFS-related System events, storage events, and any transaction or recovery trace. Keep the first detailed status even when a later wrapper translates it to error 6641; the first status often distinguishes transport, authorization, storage, schema, state, and application-integrity causes that share the same final Win32 result.

Handling, retry, and recovery

The recovery objective is to restore the expected container path and permissions or restore the log as a coordinated set; do not create an empty replacement over missing recovery data.

Retry it only after the recorded condition changes and completion state is known. Idempotent queries may be repeated after recovery, but mutations require a state check first; backoff cannot repair malformed input, corruption, missing structure, or policy rejection.

Telemetry and support fields

• record log_container_open_failed_api for the producing function or management operation.
• record log_container_open_failed_target for the file, log, session, replica, object, or server identity.
• record log_container_open_failed_state_before and log_container_open_failed_requested_transition.
• record log_container_open_failed_first_status for the earliest lower-level diagnostic.

For support escalation involving it, retain decimal 6641, hexadecimal 0x000019F1, the API, UTC time, target identity, and first subsystem-specific status. Include the smallest reproducible request and evidence that distinguishes this condition from nearby codes. In the context of it, clfs clients can run in user mode or kernel mode, so the same win32 result may be returned through an application wrapper, a service, or a driver-facing management path.

Difference from nearby results

ERROR_LOG_CONTAINER_READ_FAILED starts with an open container and fails during data access; this code prevents the container from being opened at all.

Practical validation scenario

A restore copies the base log but omits one container stream. CLFS identifies the missing descriptor during open; restoring the matching container set resolves the error without rebuilding an empty log. The negative test should preserve the responsible condition and reproduce it; the recovery test should change only the identified cause, repeat the same operation, and verify both success and the absence of an unintended partial side effect.

Developer and administrator guidance

Administrators handling it should preserve the complete CLFS set—base log, containers, security metadata, and application checkpoint state—before repair. Developers should never delete or recreate a container merely because its path appears in the error; the owning recovery protocol determines whether that data is still required. Code that exposes it through RPC, JSON, REST, PowerShell, or another protocol should preserve the Win32 domain, decimal 6641, hexadecimal 0x000019F1, and original component diagnostic.

References

• Microsoft: Win32 system error range containing this code — official context relevant to it.
• Microsoft: Common Log File System — official context relevant to it.
• Microsoft: Creating a Log File — official context relevant to it.
• Microsoft: Introduction to CLFS — official context relevant to it.

Looking for a different code? Search another status or error code.