| Previous | Next |
| ERROR_NOT_GUI_PROCESS | ERROR_EVENTLOG_CANT_START |
ERROR_EVENTLOG_FILE_CORRUPT
The event log file is structurally damaged.
ERROR_EVENTLOG_FILE_CORRUPT is Win32 error 1500 (0x5DC). It means the event-log subsystem cannot trust the on-disk log structure. The affected file may be a live channel or an exported .evtx/.evt file. Missing provider message resources can make event text look incomplete, but that is not file corruption; error 1500 concerns the log container itself.
How corruption can arise
- storage or filesystem faults damaged records, chunks, headers, or allocation metadata
- an abrupt power loss interrupted a write on unreliable storage
- a copied or downloaded log file was truncated or modified
- third-party software edited, compressed, or restored the file incorrectly
- an older reader is being used against an unsupported or malformed file
Evidence to collect before repair
Record channel name or full file path, file size, timestamps, volume health, operating-system build, Event Log service state, API and flags used, and a cryptographic hash of the damaged file. Preserve a read-only copy when incident response or audit requirements apply. Also note whether other channels on the same volume open correctly.
Diagnostic sequence
Determine whether the problem affects one exported file, one live channel, or the event-log service broadly. Try the supported Windows Event Log APIs or wevtutil rather than a custom binary parser. Inspect filesystem and storage diagnostics, then compare the file against a known-good backup or another machine only for format expectations, not as a replacement.
If the channel still accepts new events, export what remains readable before clearing or recreating it. When a forensic investigation is active, do not clear the original until evidence retention requirements are satisfied. A provider metadata problem should be investigated separately because replacing message DLLs will not repair a corrupt log file.
Recovery
Restore a verified backup or use supported channel clear/recreation procedures after preserving evidence. For an offline exported log, obtain a fresh export from the source if available. Correct underlying disk, controller, or power problems before declaring the issue resolved. Applications that consume logs should checkpoint record identifiers and tolerate the loss of one source without repeatedly reopening a known-corrupt file.
Difference from a changed log
ERROR_EVENTLOG_FILE_CHANGED reports that the file changed between read operations and usually calls for reopening or restarting enumeration. Error 1500 says the structure itself is corrupt and may not become readable through a fresh handle.
Example
A collector receives an .evtx copied while another tool was transferring it across a failing share. The file is shorter than the source and returns 1500. Re-exporting to a local file and verifying its hash succeeds; repeatedly reopening the truncated copy would never repair it.
References
Looking for a different code? Search another status or error code.