Error message when you try to view events in an event log on a Windows Server 2003 SP1-based computer: "The event log file is corrupt"

Consider the following scenario. On a Microsoft Windows Server 2003 Service Pack 1 (SP1)-based computer, you open and view the properties of the first event in an event log. Then, you click the UP ARROW button in the event properties to move to the last event. In this scenario, you receive the following error message:Note This error message is displayed to help you avoid access violations.

Additionally, the cache is discarded during the restoring process. If the cache is successfully discarded, you receive the following message:For example, you may experience this issue when you view events in the Security log.

This issue occurs when event logs are frequently updated in Event Viewer. When frequent updating occurs, arbitrary events are logged in the event log. Event Viewer tries to display other event files by moving the access pointer in an event file. When arbitrary events are logged, event log files are updated or overwritten by the new entries. In this scenario, the other events in the event log try to reference the relative location of the pointer. However, the relative information is lost.

To work around this issue, close and then reopen Event Viewer. When you do this, the event log entries are refreshed and are displayed correctly. For more information about how to view and manage event logs in Event Viewer, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section.

For more information about Event Viewer related issues, click the following article number to view the article in the Microsoft Knowledge Base: