You're not alone – this error is annoying but fixable
Seeing 0X0000094B with the message Log file %1 is corrupt usually means Windows can't read one of its own log files. The most common culprit is the System log in Event Viewer, but it can also hit Application or Security logs. The good news: you can fix it without reinstalling anything.
The fix: clear and rebuild the bad log
We're going to delete the corrupt log file. Windows will recreate it fresh the next time the service starts.
- Press Win + R, type
services.msc, press Enter. - In the list, scroll down to Windows Event Log. Right-click it and choose Stop. Wait until the Status column says blank (not Running).
- Now press Win + R again, type
%SystemRoot%\System32\winevt\Logs, press Enter. That folder holds all the .evtx log files. - Look for the file mentioned in the error. If you saw Log file %1 is corrupt without a specific name, the System log is the usual suspect. Find
System.evtx. - Right-click that .evtx file and choose Delete. Windows might ask for permission – click Yes. If it says the file is in use, you didn't stop the service completely. Go back and double-check step 2.
- Close the folder. Go back to the Services window. Right-click Windows Event Log and choose Start.
- Open Event Viewer: press Win + R, type
eventvwr.msc, press Enter. Click Windows Logs > System. You should see a fresh log with recent entries. The error is gone.
After step 6, the log folder will have a brand new System.evtx file. Event Viewer will show events from the moment the service started – you lose old log history. That's the trade-off.
Why this works
Windows stores log data in binary .evtx files. When one gets corrupted (bad shutdown, disk error, or third-party software messing with it), Event Viewer can't parse it and throws 0X0000094B. Deleting the file forces the Event Log service to create a new, clean file. It's like shredding a torn document instead of trying to tape it back together.
I've seen this happen most often after a power loss or a forced shutdown. Anti-malware tools that scan log files aggressively can also trip it up. The fix is the same regardless.
Less common variations
The error names a different log
If the error specifies Application.evtx or Security.evtx instead of %1, just target that file in step 4. The process is identical.
Error pops up in a third-party app
Some older software (I've seen this with Symantec Endpoint Protection and certain backup tools) has its own log files. The error might come from that program, not Windows. In that case, check the app's documentation for how to clear its logs – often it's a simple .log file you can rename or delete.
You can't stop the Event Log service
If the service won't stop, open an admin Command Prompt and run: net stop EventLog /y. That forces it. Then delete the file and start the service again with net start EventLog.
Multiple logs corrupted
If the error keeps reappearing after fixing one log, repeat the steps for Application.evtx and Security.evtx. I've seen all three go bad at once after a serious crash.
How to prevent it from coming back
The key is avoiding sudden shutdowns. If you're on a laptop, keep it plugged in during updates. On a desktop, use a UPS if power drops are common in your area. Also, don't let antivirus software scan inside the winevt\Logs folder – add it to exclusions. Real-time scanning of live log files can corrupt them.
Finally, set a reasonable log size. Open Event Viewer, right-click System (or any log) under Windows Logs, choose Properties. Change Maximum log size to something like 20 MB. That keeps the file small enough that corruption is less likely, but big enough to keep a few days of history. Check the box Overwrite events as needed so old entries don't fill it up.
One last thing: if you're on Windows Server and this happens repeatedly, check disk health. Run chkdsk C: /f from an admin command prompt. Bad sectors on the drive can corrupt logs over time.