0xC01A0019: Log record is not a record — real fix

Cause #1: Corrupted Event Log file from a bad shutdown

The culprit here is almost always a corrupted .evtx file in C:\Windows\System32\winevt\Logs. This happens when the system loses power or blue-screens while writing to the log. I've seen this on Windows 10, Server 2016, and Server 2019 — same story every time. The log thinks a record exists but the file got truncated or written wrong.

Step 1: Identify which log is broken

Open Event Viewer (eventvwr.msc). Look for the error under Windows Logs — usually System or Application. The error will show which log file is hosed. Note the Log Name field (e.g., "System", "Application", "Security").

Step 2: Stop the Event Log service and delete the corrupt file

You can't clear a log while the service is running. Run this in an elevated Command Prompt (Admin):

net stop EventLog

Then navigate to C:\Windows\System32\winevt\Logs. Find the .evtx file that matches your broken log. For the System log, it's System.evtx. Rename it to System.evtx.old or delete it — I always rename first in case you need it for forensics later.

ren System.evtx System.evtx.old

Now restart the service:

net start EventLog

Windows will create a fresh empty log file automatically. Check Event Viewer — the error should be gone. If the error comes back, move to Cause #2.

Cause #2: Disk errors damaging log files

If the log keeps corrupting, your disk is likely failing or has file system issues. Bad sectors or NTFS corruption can trash any file, including logs. Don't bother with any fancy log recovery tools here — the real fix is fixing the disk.

Step 1: Run chkdsk

Open an elevated Command Prompt and run:

chkdsk C: /f /r

You'll get a prompt to schedule it at next reboot. Say Y and restart. This scans and fixes file system errors and bad sectors. Expect it to take 30 minutes to a few hours on larger drives. Don't skip the /r flag — it finds bad sectors and recovers readable data.

Step 2: Check disk health with SMART

After chkdsk, run WMIC to check the disk's SMART status:

wmic diskdrive get status

If it says anything other than "OK", replace the drive. No amount of software fixes will help a dying disk. I've had SSDs show OK but still corrupt logs — trust the error, not the report. If the problem persists, the drive is lying about its health.

Cause #3: Buggy third-party driver or filter driver

This one's trickier. Some drivers hook into the file system and mess up log writes. Antivirus, backup software, and even some RAID drivers are known offenders. The error shows up sporadically — not tied to any specific event.

Step 1: Boot into Safe Mode

Safe Mode loads only Microsoft drivers. If the error disappears, you've got a third-party driver problem. Reboot and mash F8 (or Shift + Restart from the login screen), choose Safe Mode with Networking.

Step 2: Identify the culprit

Use Driver Verifier Manager (verifier.exe) — but be careful. It can cause a boot loop if you enable it on too many drivers. Instead, manually check your installed drivers:

driverquery /v

Look for drivers from non-Microsoft publishers. Common suspects: any driver from Symantec, McAfee, or older RAID controllers (LSI, Adaptec). Disable them one by one in Device Manager or use sc config to set them to disabled.

Step 3: Update or remove the offending driver

Go to the manufacturer's site and grab the latest driver. If none exists, remove the software entirely. For antivirus, use their official removal tool — don't just uninstall from Control Panel, they leave filter drivers behind.

Quick-reference summary

Start with Cause #1 — that's the fix in 80% of cases. If it comes back, you're dealing with a disk or driver issue. Don't waste time on log recovery tools; they rarely work. Quick break: the log file is just a file. If it's broken, replace it.