Solved

Very Odd anyone see Event Viewer do this before?

Posted on 2003-10-31
8
623 Views
Last Modified: 2010-03-18
2k4 Server.

When I look at at event the event view System Log the screen is blank even though it says that there are 2,347 events.

The other logs will also show a blank screen with 0 events but if I refresh then numerous events show up.

No matter how many time I refresh on the System Log I cannot see the events.

If I export the events and copy them to another computer then I can see the events.

I have never seen this behavior before, anyone else?
0
Comment
Question by:praflik
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 5

Expert Comment

by:juliancrawford
ID: 9661586
When a log is very large and your PC not so fast then there can be quite a delay for the log to appear.
Have you tried waiting a few minutes?
0
 
LVL 1

Author Comment

by:praflik
ID: 9672013
The server is only six months old.  The behavior started just recently after the upgrade to SP4.  Proc is 2.0G and it is not a very busy srever.  This was working just fine.
0
 
LVL 5

Accepted Solution

by:
vtobusman earned 50 total points
ID: 9672050
 I have seen this and it has to do with the large files heres what i did...
 right click on the log and go to properties  verify the max size is like 512k
and then click the box that says " Overwrite as needed "

   You will have to clear the log then it will start working since i have done this i have had no issues...

  Hope it works for you ... Good Luck
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 
LVL 1

Author Comment

by:praflik
ID: 9673484
Thank you.  Clearing the log has fixed the problem.
0
 
LVL 5

Expert Comment

by:vtobusman
ID: 9673550
 remember to check the box overwrite as necessary and it wont happen again
0
 

Expert Comment

by:foxp44
ID: 9693198
I have had this on a number of occasions

Causeed by blaster stopping the svchost rpc service.

check your network for msblaster
0
 
LVL 1

Author Comment

by:praflik
ID: 9701828
vtobusman,

Overwrite was nad is checked.  Log was only 512k.  Clearing fixed the problem so the problem wasn't a too large log file but the same fix applied.

foxp44, no blaster, we are well protected against that bugger.
0
 

Expert Comment

by:andrewwarby
ID: 10327410
Please view Microsoft Knolegebase article #: 829246 for a permantent fix for this bug.

You will need to contact Microsoft Product Support services to request this Post SP4 Patch

The problem is cuased by the Event Log not wrapping and becoming corrupt.

The other acceptable fix is to Disable the Event Service, restrt the server, delete the .Evt files enable the Event Service and reboot the server. Then set the Event Logs to automatically overwrite once they reach the set size (e.g. 512kb)

The best permantent fix though is the patch.

Cheers,
Andrew
0

Featured Post

[Live Webinar] The Cloud Skills Gap

As Cloud technologies come of age, business leaders grapple with the impact it has on their team's skills and the gap associated with the use of a cloud platform.

Join experts from 451 Research and Concerto Cloud Services on July 27th where we will examine fact and fiction.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes you might need to configure routing based not only on destination IP address, but also on a combination of destination IP address (or hostname) and destination port number. I will describe a method how to accomplish this with free tools. …
Have you ever set up your wireless router at home or in the office to find that you little pop-up bubble in the bottom right-hand corner of Windows read "IP Conflict - One of more computers on the network have been assigned the following IP address"…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question