ERROR_LOG_PINNED (0X000019F4) Fix: Reclaim Log Space

Quick answer

Check for a stuck Volume Shadow Copy (VSS) backup—run vssadmin list writers and restart the VSS service if needed. If that's not it, identify the process holding the log pin with handle.exe from Sysinternals and kill it.

Why this error happens

You're seeing ERROR_LOG_PINNED (0x000019F4) because the system can't reclaim space in a log file—someone or something has 'pinned' it. Pinning usually happens when a Volume Shadow Copy (VSS) backup is running and hasn't completed, or when a transaction (like an NTFS file operation or a SQL Server transaction) is stuck. The log can't be truncated or recycled until the pin is released. This tripped me up the first time too—I spent hours thinking I had disk corruption, but it was just a backup job that hung overnight.

Step-by-step fix

Identify the culprit — Open an elevated Command Prompt (right-click, Run as Administrator) and run vssadmin list writers. Look for any writer in a 'Failed' or 'Stable (with errors)' state. Also check Event Viewer under Applications and Services Logs/Microsoft/Windows/VSS for Event ID 5139 or related errors.
Restart the VSS service — If you see a stuck writer, run net stop vss and then net start vss. This forces VSS to release all pins. Warning: This will interrupt any active backup—make sure you're not mid-backup.
Check for open handles — Download Handle v5.0 from Sysinternals. Run handle.exe -a -p log in the target log's directory (e.g., C:\Windows\System32\winevt\Logs). This shows which process has pinned the file.
Kill the process — If handle.exe shows a PID (e.g., 4820), run taskkill /PID 4820 /F. Be careful—kill only processes you recognize (like a backup agent, not lsass.exe).
Force log reset — If the log itself is corrupted or you can't release the pin, reset it. For NTFS transaction logs, run fsutil resource setlog /reset C: (replace C: with the drive). This clears the log—use this as a last resort because it discards uncommitted transactions.

Alternative fixes if main steps fail

Reboot the server — A restart releases all file handles and resets VSS writers. This is the nuclear option but works 90% of the time.
Use Microsoft's Process Monitor — Filter on Path contains .log and look for processes with 'CreateFile' or 'ReadFile' operations. This shows live access.
Check SQL Server — If you're on a database server, run DBCC OPENTRAN to see if a transaction is stuck. Kill it with KILL session_id.
Disable VSS temporarily — In extreme cases, disable the Volume Shadow Copy service via sc config vss start= disabled, reboot, then re-enable it after the fix.

Prevention tip

Set VSS backup jobs to run during low-traffic windows and always monitor them with alerts. I also recommend trimming log retention—keep only 7 days of transaction logs for NTFS and SQL Server. Use fsutil usn deletejournal /N /D C: to clear the USN journal if it's pinned, but test this in a lab first—it can break file change tracking.

Real-world scenario: I saw this on a Windows Server 2019 running Hyper-V. A backup agent from Veeam had a stuck VSS snapshot. Running vssadmin list shadows showed an orphaned snapshot. I deleted it with vssadmin delete shadows /shadow={GUID} and the error vanished.