| Previous | Next |
| STATUS_REMOTE_SESSION_LIMIT | STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT |
STATUS_EVENTLOG_FILE_CHANGED
The Event Log changed between reads
An Event Log reader can maintain a cursor or query result while the underlying channel continues to receive events, rolls over, is cleared, or otherwise changes. This status warns that the file observed by the reader is no longer the same stable view used for the earlier read.
Do not continue incrementing the old cursor and assume record continuity. Save the last event record identifier or bookmark you trust, close the stale query or log handle, reopen the log, and re-establish position according to the application's duplicate-handling policy.
What to inspect
- Record the channel or file path and the last successfully consumed event identifier.
- Check for clear, rollover, archive, or replacement activity during the read.
- Reopen the query and deliberately handle duplicates or gaps around the last bookmark.
References
- Microsoft: Windows Event Log functions
- Microsoft Open Specifications: clearing an Event Log channel
- Microsoft Open Specifications: MS-EVEN6
Looking for a different code? Search another status or error code.