Event Viewer Corrupt !!

[rflora]

Hello,

I just installed windows 2000 pro and upgraded to windows xp pro. When i go to the event view and go to the "system" events it says the file is corrupt. So as soon as i click on System I get the corrupt file message. Any ideas as why that would happen ? And most importantly how can i fix this!!

 

[linney]

If you right-click on the System folder (and it opens for you without the error message) you have an option to "Clear All Events". It might be worth trying that.

Alternatively if you browse to C:\WINDOWS\system32\config, you will find the actual SysEvent.Evt file, if you delete this (via Recovery Console) after backing it up, that might help.

HOW TO: Install and Use the Recovery Console for Windows XP (Q307654)

http://support.microsoft.com/support/kb/articles/q307/6/54.asp

You could also run ChkDsk /r from the Recovery Console or normally by right-clicking on your Drive icon/ Properties/ Tools/ Error Checking.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

 

[rflora]

Thanks for the reply, I've tried the "Clear All Events" before but that didn't help. I'll try the other things you've suggested tonight and let you know how it went. Thanks!

 

[linney]

It would help if you posted the "exact" error message you are receiving.

How did the Install and Upgrade of 2000 behave, were there any unusual problems? Why didn't you just clean install XP (with the upgrade version) and use the 2000 (or other qualifying CD) when asked for?

A qualifying product is a Windows 98, 98se, 2000 or ME CD (retail, not OEM or recovery type CD's), which will be checked during the install of XP.

 

[rflora]

Initially I was planning to keep Windows 2000 Pro, but after I got a hold of XP Pro. There weren't any unusual issues during the install, but after I did get a blue screen of death and I got this message ..

cdfs.sys - Address F734C9C6 Base at F734B000 Date Stamp 41107eb1

I'm not sure what this is, but it could be related to my All in wonder 9000 Ati video card, i'm guessing this because that's the only card I have installed on the motherboard, all other slots are empty. I haven't updated the driver for it yet, perhaps tonight. I did a search on that error, but found nothing. Any other ideas?

ps: I dont have the exact message on me right now as i'm at work and this is my home computer. But it was something like event log file corrupt .. when i click on system. Thanks.

 

[linney]

You cannot delete or rename the log files while the Event Log service is running. If you disable this Service you should be able to delete the SysEvent.Evt file without resulting to the Recovery Console.

Have you read the posts here?

http://www.google.com/search?source...G:2005-48,GGLG:en&q=event+log+file+corrupt+xp

http://groups.google.com/groups?sou...G:2005-48,GGLG:en&q=event+log+file+corrupt+xp