0xC01A0021: Log Archival in Progress – Fix It Now

When This Error Hits

You're running a backup job—maybe Windows Server Backup, maybe a third-party tool like Veeam or Acronis—and it fails with STATUS_LOG_ARCHIVE_IN_PROGRESS (0xC01A0021). Or you're trying to export Event Viewer logs manually, and the export just hangs. Happens most often on Windows Server 2016 or 2019, but I've seen it on Windows 10 Pro too. Last month, a client's nightly backup kept failing because a scheduled log rotation script hadn't finished archiving the previous day's logs. The error code itself is clear: the log archive operation is still running, and whatever you're trying to do can't proceed until it finishes.

What's Actually Happening

Windows uses a transaction log system—think of it like a scratch pad where it writes changes before committing them. When you trigger an archive (manually or via a scheduled task), it needs to flush those pending writes and seal the current log file. The error means that flush is still in progress. The root cause is usually one of these:

• A previous archive operation didn't complete cleanly (power loss, forced reboot, or a buggy script).
• Another process holds a lock on the log file—like an antivirus scan or a backup tool that's also reading the log.
• The log file itself is corrupted or the disk is slow (I once had a failing HDD cause this exact error).

How to Fix It – Step by Step

Step 1: Identify the Stuck Archive

Open an elevated PowerShell or CMD and run:

wevtutil gl "Application" > C:\logstate.txt

Check the output for a line like archiving: true. If it's true, the archive is stuck. Replace "Application" with the log name you're targeting (e.g., "System", "Security", or a custom log).

Step 2: Force the Archive to Complete

If it's stuck, you can trigger a new archive to push it through. Run:

wevtutil al "Application" /l:C:\backuplogs\archive.evtx

This forces a fresh archive to the specified path. Wait 30 seconds. Then check if the original log is still archiving with the wevtutil gl command again. Usually, the stuck state clears after this.

Step 3: Kill the Hung Process

If step 2 doesn't work, something's holding the log file. Run:

wevtutil el

This lists all logs. Note the log name that's causing trouble. Then stop the Windows Event Log service (temporarily) with:

net stop EventLog /y

Wait 10 seconds, then restart it:

net start EventLog

This clears any locks. Rerun your backup or export—it should work now. I've used this trick on dozens of servers. Just be aware: stopping EventLog will lose any events that haven't been written yet. Not ideal, but it's a safe gamble if your backup is critical.

Step 4: Clean the Log (Nuclear Option)

If the log itself is corrupted (wevtutil gl shows errors), you can clear it:

wevtutil cl "Application"

This wipes the log entirely. All events gone. Use this only if you've already backed up the log or don't need it. I've had to do this on a domain controller where a corrupted Security log kept the whole server from booting.

If It Still Fails

Check the disk where the logs live (usually C:\Windows\System32\winevt\Logs). Is it full? Is it failing? I recommend running chkdsk C: /f and checking SMART stats with wmic diskdrive get status. Also, look for scheduled tasks that might be archiving logs on a timer—disable them temporarily to see if it fixes the conflict. And if you're using a third-party backup tool, check its logs for lock contention. I've seen backup software hold log files open indefinitely.

One last thing: if nothing else works, reboot the machine. A clean boot releases all file locks and resets the log archive state. It's brutal but it works every time.