| Previous | Next |
| ERROR_LOG_FILE_FULL | ERROR_CONTAINER_ASSIGNED |
ERROR_EVENTLOG_FILE_CHANGED
The log changed between read operations, so the current enumeration is no longer stable.
ERROR_EVENTLOG_FILE_CHANGED is Win32 error 1503 (0x5DF). A reader opened a log and later found that the underlying file or sequence no longer matches the handle’s previous state. Clearing, restoring, rotating, replacing, or externally modifying a log can invalidate record positions. The code normally calls for reopening and resynchronizing, not treating the file as corrupt.
Events that invalidate a reader
- an administrator or maintenance task cleared the channel
- the log file was archived, replaced, restored, or rotated during collection
- a legacy reader uses sequential record positions across a structural change
- the collector resumed from a bookmark that no longer exists in the current log
- backup or security software swapped the file outside the expected API lifecycle
State to record
Capture channel or file path, reader API, query flags, bookmark or last record ID, file size and timestamp before and after failure, clear or maintenance operations, session type, and whether the source is local or remote. Correlate with administrator actions and channel configuration. Do not assume record numbers are permanent identities across clear and restore operations.
How to recover enumeration
Close the stale query or log handle and open a fresh one. Decide from product policy whether to continue from the oldest available record, the newest record, or a durable bookmark that still resolves. Detect gaps and report them explicitly; silently jumping forward can hide lost audit data.
For modern consumers, use Windows Event Log bookmarks and subscriptions with documented stale-bookmark handling. Serialize checkpoint updates only after downstream processing commits, so reopening does not create unbounded duplicates. If a maintenance workflow intentionally clears logs, coordinate it with collectors or archive first.
Prevention
Avoid manipulating live event-log files directly. Use EvtExportLog, EvtClearLog, and other supported APIs. Collectors should expect log replacement as a normal race and implement bounded reopen logic, duplicate suppression, and gap telemetry. Repeated 1503 results without administrative activity warrant investigation of backup, antivirus, or storage software.
Difference from corruption
ERROR_EVENTLOG_FILE_CORRUPT says the file structure cannot be trusted. Error 1503 says the reader’s earlier view became obsolete. A fresh open may fully resolve 1503, while it will not repair a corrupt file.
Example
A collector reads a legacy log sequentially while an administrator clears it after export. The next read returns 1503 because the old record position no longer belongs to the current file. The collector reopens, records a clear boundary, and resumes according to policy instead of marking the channel corrupt.
References
Looking for a different code? Search another status or error code.