Empty Event Log

[FulcrumSys]

Ok, I haven't seen this one before. It is a windows 2000 server, that seems to be operating OK except for the event log is not logging anything...shutdowns...logons...nothing. The service is turned on but there is no data in the logs. The properties for the event viewer look ok...What am I missing?

 

[Jpoandl]

I heard that there is a bug that could be causing this. Here is the fix:

http://x220.win2ktest.com/forum/topic.asp?TOPIC_ID=6895

Joseph L. Poandl
MCSE 2003

If your company is in need of experts to examine technical problems/solutions, please check out

http://www.NJCOMPUTERNETWORKS.com

(Sales@njcomputernetworks.com)

 

[penauroth]

Check your Domain Controller Security Policy.

Security Settings > Event Log > Settings for Event Logs



Paul

Work on Windows, play on Linux.

 

[mlichstein]

This is a bug in 2000. If you clear your log (preferably save then clear), it should start logging again.

Also you can open a (FREE) case with PSS for a hotfix.

 

[bowfonz]

You have to turn on auditing either in User Manager for an NT domain or in the Default Domain GP in Active Directory, otherwise you will see nothing in the security event log.

Have you done that?

 

[mlichstein]

I don't recall the poster saying only the security log was empty. Sounds like they all are.

 

[bowfonz]

The reason I made the suggestion is because it infact sounds like only the security log. All that is mentioned is shutdowns (aka logoffs) and logons which are both logged in the security log which is empty by default until you enable auditing.

So what's the word FulcrumSys? Is it all the logs or just the security log?

 

[FulcrumSys]

Thanks Folks.

Jpoandl described the problem to a T. I've got to guess this is related to the bugs mentioned in the attached link. Today, I was able to look at it again. I was able to view the log by creating another snap-in. What I noticed was that I could view all but the last log. The screwy thing was that once I viewed the last log...I believe it was the system log, from that point onward I could not view any data in the previous logs. Jpoandl's line describes this exact scenario. Thanks again for all of your help.