I didn't get any help on the TechNet forum so I'm going to try my luck here :).
Our web server is running Server 2008 SP1, 64-bit Standard Edition. For the past week or so, we've been experiencing repeated corruption in the Application event log. Each time, we can fix the corruption by clearing the log. But the corruption always comes back, sometimes within an hour or two.
We have a PowerShell script which checks the event log periodically and emails us about error events. Once the log has become corrupt, running "get-eventlog Application" from PowerShell produces the following output:
Get-EventLog : Cannot read log entry number 696. The event log may be corrupt.
At line:1 char:13
+ get-eventlog <<<< Application
Usually there are several valid event log entries displayed before the corruption error.
The other event logs (System, Security, and so on) are not experiencing this corruption.
If I look at the Application log in the event viewer, I see several events with no information at all. In the list view, they show the "information" icon, but all other columns are blank. In the "general" and "details" tabs, everything is blank.
I thought about disk corruption. But since this is only affecting the event log, I'm skeptical that the disks are the cause. The server has a single RAID-1 array which shows a status of healthy. Write caching is disabled. All applications and sites hosted on the server appear to be working fine; only the event log is having problems.
On TechNet, someone replied saying it sounded like a PowerShell problem – but it isn't, since the corruption is also visible through the Event Viewer GUI.
I'd appreciate any ideas you might have for finding the cause of this problem…
Thanks,
Richard
Best Answer
Per Oskar Duveborn's suggestion try disabling applications to see if you can isolate one causing the log corruption. Is there any pattern to good logs just before it goes corrupt?
Maybe there is something wrong with hard drive or location the Event Log being stored at, which causes the corruption. See kb 315417 to try moving it to a different folder, or better yet, a different hard drive. At least temporarily to see if that is the problem.