Event log file is corrupted (0x000005DC) — fix it now

1. The log file is full (this is the real culprit 9 times out of 10)

I've seen this error hundreds of times. The event log file grows until it hits the max size, then Windows throws 0x000005DC and refuses to write anything else. The fix? Clear it. But don't just open Event Viewer and hit "Clear Log" — that can leave behind a corrupt header.

Here's the method that actually works:

1. Open an elevated Command Prompt (right-click Start > Command Prompt (Admin) or PowerShell as Admin).
2. Stop the Event Log service by running:

   net stop EventLog

3. Delete the log files themselves. They live in C:\Windows\System32\winevt\Logs. Don't delete the folder — just the files inside. The main ones are Application.evtx, System.evtx, and Security.evtx.
4. Restart the service:

   net start EventLog

That's it. Windows will create fresh log files when it restarts the service. You won't lose system functionality — just old data. If you need those old logs for auditing, back them up first by copying the .evtx files elsewhere.

I've used this on Windows 10, 11, Server 2016, 2019, 2022. Works every time. If you still see the error after this, move to fix #2.

2. Corrupted registry entry for the log file

Less common, but when it happens, the error pops up immediately after boot. The registry key that tells Windows where to find the event log file gets mangled — maybe from a bad shutdown, maybe from an incomplete update.

Here's how to check and fix it:

1. Open Regedit (Win+R, type regedit).
2. Go to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application

   Also check the System and Security subkeys under Services\EventLog.

3. Look for a value named File. It should point to something like %SystemRoot%\System32\winevt\Logs\Application.evtx. If it's pointing to a non-existent path or has weird characters, you've found the problem.
4. Right-click the File value, select Modify, and set it to the correct path. For example, for the Application log: %SystemRoot%\System32\winevt\Logs\Application.evtx.
5. Reboot. The error should vanish.

If you're not sure what the correct path should be, compare it to a working machine's registry. I usually just copy the value from another log subkey (like HardwareEvents) and change the filename.

3. Disk corruption or bad sectors where the log files live

This one's rare but nasty. If the physical disk sector storing the .evtx file goes bad, Windows can't read it, and you get 0x000005DC. You'll usually see other signs too — slow reads, file copy errors, maybe other disk-related bluescreens.

First, check if the disk has errors:

1. Open an elevated Command Prompt.
2. Run:

   chkdsk C: /f /r

   Replace C: with the drive where Windows is installed. If it's your system drive, you'll be prompted to schedule a check on next reboot — say yes and restart.

3. After the scan, try the fix from #1 again (delete the log files and restart the service).

If chkdsk finds and repairs bad sectors, the event log corruption might be permanent — those sectors are toast. You still need to delete the affected .evtx files to get the Event Log service working again. If the same error returns regularly, your disk might be dying. Back up your data and consider replacing the drive.

One last thing: if none of these work, you might have a deeper issue like a corrupted service or a malware infection that's deliberately trashing logs. In that case, a repair install of Windows (using the "Keep personal files" option) usually does the trick. But honestly, for 95% of people reading this, fix #1 is all you need. Good luck.