Guest Sajid Posted March 22, 2008 Posted March 22, 2008 We are using Windows Server 2003 SP1, last week we had a power outage, due to which server was re-booted without proper shut down. After getting up the server eventlog is all mixed up, that is all three Application, System and Security logs are coming in all three (if you click on Application, System and Security logs are shown as well, same with the other two). I checked the Log file names they are pointing to, and it seems to be right, Application eventlog is pointing to AppEvent.Evt, the other two to SecEvent.Evt and SysEvent.Evt respectively. We want to know what might've happened that has caused this and what can we do repair it, without affecting the rest of the server. The other abnormal thing after the power outage has been the delay in showing up of the login screen, after we use the remote connection to connect to the server, previously it used to load up immediately, now it takes around 20 to 40 sec, any idea why? Regards Sajid
Guest Dave Patrick Posted March 22, 2008 Posted March 22, 2008 Re: EventLog Mixed The files may be corrupt. Control Panel|Administrative Tools|Services|Event Log Service|General, set the "Startup Type:" to "Disabled" restart the pc, then delete (or move) the corrupt *.evt file(s) from %systemroot%\system32\config then set the Event Log Service "Startup Type:" back to "Automatic", restart for effect. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "Sajid" wrote: > We are using Windows Server 2003 SP1, last week we had a power outage, due > to > which server was re-booted without proper shut down. After getting up the > server eventlog is all mixed up, that is all three Application, System and > Security logs are coming in all three (if you click on Application, System > and Security logs are shown as well, same with the other two). > > I checked the Log file names they are pointing to, and it seems to be > right, > Application eventlog is pointing to AppEvent.Evt, the other two to > SecEvent.Evt and SysEvent.Evt respectively. We want to know what might've > happened that has caused this and what can we do repair it, without > affecting > the rest of the server. > > The other abnormal thing after the power outage has been the delay in > showing up of the login screen, after we use the remote connection to > connect > to the server, previously it used to load up immediately, now it takes > around > 20 to 40 sec, any idea why? > > > Regards > Sajid
Guest Sajid Posted March 23, 2008 Posted March 23, 2008 Re: EventLog Mixed Thanks Dave We tried your suggestion, but it is still the same. We checked the registry entries for the EventLog and there seems to be some invalid entries, if that is the case, whats a safer way of restoring the eventlog to its orignal state? Regards Sajid "Dave Patrick" wrote: > The files may be corrupt. Control Panel|Administrative Tools|Services|Event > Log Service|General, set the "Startup Type:" to "Disabled" restart the pc, > then delete (or move) the corrupt *.evt file(s) from > %systemroot%\system32\config then set the Event Log Service "Startup Type:" > back to "Automatic", restart for effect. > > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "Sajid" wrote: > > We are using Windows Server 2003 SP1, last week we had a power outage, due > > to > > which server was re-booted without proper shut down. After getting up the > > server eventlog is all mixed up, that is all three Application, System and > > Security logs are coming in all three (if you click on Application, System > > and Security logs are shown as well, same with the other two). > > > > I checked the Log file names they are pointing to, and it seems to be > > right, > > Application eventlog is pointing to AppEvent.Evt, the other two to > > SecEvent.Evt and SysEvent.Evt respectively. We want to know what might've > > happened that has caused this and what can we do repair it, without > > affecting > > the rest of the server. > > > > The other abnormal thing after the power outage has been the delay in > > showing up of the login screen, after we use the remote connection to > > connect > > to the server, previously it used to load up immediately, now it takes > > around > > 20 to 40 sec, any idea why? > > > > > > Regards > > Sajid > >
Guest Dave Patrick Posted March 23, 2008 Posted March 23, 2008 Re: EventLog Mixed That was my next step to look at the registry entries. Depending on how comfortable you are with editing the registry you could try exporting the keys from another like machine and import on the affected machine. Be sure you have a backup before proceeding. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "Sajid" wrote: > Thanks Dave > > We tried your suggestion, but it is still the same. We checked the > registry > entries for the EventLog and there seems to be some invalid entries, if > that > is the case, whats a safer way of restoring the eventlog to its orignal > state? > > > Regards > Sajid
Guest Sajid Posted March 23, 2008 Posted March 23, 2008 Re: EventLog Mixed Dave We've a similar machine in terms of configuration, but it wont have similar entries, right?. If we just want to replace the EventLog entries, by any automated way to orignal, as on the time of installation, is there any way of doing it? Regard Sajid "Dave Patrick" wrote: > That was my next step to look at the registry entries. Depending on how > comfortable you are with editing the registry you could try exporting the > keys from another like machine and import on the affected machine. Be sure > you have a backup before proceeding. > > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "Sajid" wrote: > > Thanks Dave > > > > We tried your suggestion, but it is still the same. We checked the > > registry > > entries for the EventLog and there seems to be some invalid entries, if > > that > > is the case, whats a safer way of restoring the eventlog to its orignal > > state? > > > > > > Regards > > Sajid >
Guest Dave Patrick Posted March 23, 2008 Posted March 23, 2008 Re: EventLog Mixed See the section labeled "How to Repair Your Installation of Windows" http://support.microsoft.com/kb/325375 Last Known Good wouldn't work since the machine successfully starts. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "Sajid" wrote: > Dave > > We've a similar machine in terms of configuration, but it wont have > similar > entries, right?. If we just want to replace the EventLog entries, by any > automated way to orignal, as on the time of installation, is there any way > of > doing it? > > > Regard > Sajid
Recommended Posts