Event Log is empty

[DTracy]

We have a 2K server that is part of a 2K3 LAN. This server was attacked by virus and since then it has no event log. The service opens, but has no entries. I know there should be entries because this is also a print server and it used to fill the event log rather quickly. Also, I have restarted the server and there are no entries in the log to indicate a restart.

Any ideas how to restart this would be greatly appreciated.

Thanks and regards,
David.

 

[brontosaurus]

If you can, set the Event log service to disabled, then reboot the server into repair mode and delete the .evt files in the system32\config directory. Bring the server up normally and restart the Event service. Check the log configuration to see that it's set the way you prefer.

 

[NetworkEngineerTech]

also maybe the event log is full,
so can u right click to the event log at the event veiwer and set the configuration for all the logs to "overwrite events as needed"
and then enlarge the capacity for all the logs (the security log, the system log and all other logs) also.

 

[58sniper]

Export the log, then clear it.

Pat Richard, MCSE MCSA:Messaging CNA MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[DTracy]

Thanks for the replies.

NetworkEngineerTech-The event log is empty, no entries, nothing. It normally is full of print messages.

58sniper-The event log is already empty, that's the problem.

brontosaurs-I'll be able to down the server this weekend so I'll try your service tip then.

Regards,
David.