How to Safely Delete Corrupt Event Viewer Log Files in Windows Server 

If you encounter errors related to corrupted .evt files in the Event Viewer on Windows Server or Windows 11/10, the solution often lies in deleting those corrupted log files. Corruption can arise from various issues, such as unexpected shutdowns, malware, hardware failures, or exceeding log size limits. Here’s how you can delete the corrupted Event Viewer log files based on your partition type.

NTFS Partition

1. Backup the Registry: Before making any changes, create a backup of the registry. Open Registry Editor, go to File > Export, select a location, and save the file.
2. Stop the Event Log Service:
   • Open Run (Win + R), type services.msc, and click OK.
   • Locate the Event Log service, right-click, and select Properties.
   • In the General tab, change Startup type to Disabled, and click Stop.
3. Modify the Registry:
   • Open Registry Editor again.
   • Navigate to:

     HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventlog

   • Double-click on the Start value and set it to 4. Click OK.
4. Reboot your Computer: If prompted about stopped services, proceed with the reboot.
5. Delete Corrupted Files:
   • Open File Explorer and go to the directory %SystemRoot%System32Config.
   • Delete or move the corrupted *.evt files.
6. Restart the Event Log Service:
   • Open Services Manager, locate the Event Log service, change Startup type back to Automatic, and click Start.

FAT Partition

For FAT partitions (FAT32 or exFAT), follow these steps:

1. Create a DOS Bootable Disk:
   • Use a utility like Rufus to create a bootable USB disk with FreeDOS.
2. Configure BIOS: Set BIOS to boot from the USB drive.
3. Access DOS Prompt:
   • Navigate to the directory with the Event Viewer log files using:

     cd %SystemRoot%System32Config

4. Identify the Corrupted Files: Look for files like Sysevent.evt, Appevent.evt, or Secevent.evt.
5. Rename or Move Files: Use commands like:

   rename Sysevent.evt Sysevent.old

   or

   move Sysevent.evt C:CorruptedFiles

Additional Troubleshooting

To resolve ERROR_CORRUPT_LOG_CLEARED, perform the following:

1. Run Check Disk: Open Command Prompt and run:

   chkdsk C: /f /r /x

   Restart the PC after this command.

2. Verify Drive Status: Check your disk’s SMART status by running:

   wmic diskdrive get status

   If it indicates anything other than “OK,” consider replacing the drive.

3. Repair System Files: Execute:

   sfc /scannow

   If issues persist, run:

   DISM /Online /Cleanup-Image /RestoreHealth

4. Review Event Viewer Logs: Check under Windows Logs > System for any disk-related errors and troubleshoot accordingly.

Deleting Corrupted Log Files

To delete the corrupted log files, navigate to:

%SystemRoot%System32Config

Identify the corrupted *.evt files and use Command Prompt or File Explorer to rename or delete them.

ColoCrossing excels in providing enterprise Colocation Services, Dedicated Servers, VPS, and a variety of Managed Solutions, operating from 8 data center locations nationwide. We cater to the diverse needs of businesses of any size, offering tailored solutions for your unique requirements. With our unwavering commitment to reliability, security, and performance, we ensure a seamless hosting experience.

For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@colocrossing.com.