Fix 0X00000988: Log file missing requested record number

What is 0X00000988 and why you're seeing it

You're hitting error 0X00000988, also known as NERR_InvalidLogSeek. The full message is: "The log file does not contain the requested record number." This pops up most often in Event Viewer when you try to open a specific log, or in a command-line tool that reads event logs. I've seen this on Windows Server 2016 and 2019 mostly, but it happens on Windows 10 and 11 too.

The trigger is usually a corrupted event log file. Maybe the system crashed while writing to it, or a disk error scrambled a piece of it. The log file is there, but the index that tracks record numbers got out of sync. You're not looking at a hard drive failure, just a log file that needs a reset.

Here's the fix. Start with the 30-second option. If that doesn't work, move to the 5-minute fix. Only go to the 15-minute advanced fix if you're still stuck.

30-second fix: Restart the Event Log service

This clears the in-memory cache and forces Windows to re-read the log file headers. It works about 40% of the time.

1. Press Win + R, type services.msc, and hit Enter.
2. Scroll down to Windows Event Log. Right-click it and choose Restart.
3. Wait 10 seconds for the service to stop and restart. You'll see the status change from "Running" to blank and back to "Running."

Now open Event Viewer again. Try to access the log that gave the error. If it opens without the error, you're done. If the error comes back after a few minutes, move to the next step.

5-minute fix: Clear the corrupted log file

Restarting the service didn't cut it? The log file itself is likely damaged. You can clear it without losing future logs. But you will lose all past entries in that specific log. If you need those entries, skip to the advanced fix.

1. Open Event Viewer: press Win + R, type eventvwr.msc, hit Enter.
2. In the left pane, expand Windows Logs (or Applications and Services Logs depending on where the error appears).
3. Right-click the log that shows the error (like Application, System, Security, or a custom log). Choose Properties.
4. At the bottom of the Properties window, click the Clear Log button.
5. A prompt asks if you want to save the current log before clearing. Choose Save and Clear if you want a backup file (you can open it later but it won't fix the error), or Clear to just wipe it.
6. After clearing, the log will be empty and start recording new entries. The error should be gone.

If you get an error when trying to clear the log (like "Cannot clear the log because the file is in use"), reboot the machine and try again. That forces the service to release the file.

15-minute advanced fix: Force-rebuild the log file with wevtutil

This is for when the log is so corrupted that Event Viewer can't even open the Properties window, or when you need to preserve the log entries. wevtutil is a command-line tool that gives you direct control over event logs.

First, determine which log is broken. Look at the error message in Event Viewer or the application that reported it. It'll say something like "Log Name: Application" or "Log: Security." Write that name down.

Open Command Prompt as Administrator: press Win + X, choose Windows Terminal (Admin) or Command Prompt (Admin).

Run this command to export the current log to a backup file (change Application to your log name):

wevtutil epl Application C:\backup_application.evtx

You should see no output if it succeeds. If you get an error like "The parameter is incorrect" or "The log file is corrupted," then the export failed. That's okay. The next command will clear the log entirely.

Now run this to clear the log (again, replace Application with your log name):

wevtutil cl Application

Wait a few seconds. You should see no message — just a new command prompt line. That means it worked. If you see "The log file is corrupted" here, we have another method.

If the clear command fails:

1. Find the physical file. By default, logs are stored in C:\Windows\System32\winevt\Logs\. Look for a file named Application.evtx (or whatever your log name is, with .evtx extension).
2. Stop the Event Log service: in the same admin command prompt, type net stop EventLog and press Enter. It'll take 5-10 seconds. The service will stop, and you'll lose network access to event logs during this time.
3. Rename the corrupted file: ren C:\Windows\System32\winevt\Logs\Application.evtx Application.old
4. Start the service again: net start EventLog
5. When the service starts, it creates a fresh, empty log file automatically. The error will be gone.

After this, if you exported a backup earlier, you can open that backup file in Event Viewer by right-clicking Windows Logs and choosing Open Saved Log. But the backup won't be searchable from the main log — you'll have to use it as a separate view.

One more thing: If the error appears in a custom log (not one of the default five), the file path might be different. Run this to see the exact file location: wevtutil gl YourLogName and look for logFileName in the output. Then rename that specific file as shown above.

When none of this works

If you're still seeing 0X00000988 after all three steps, you might have a deeper issue. Check the disk for errors: run chkdsk C: /f (replace C: with your system drive) from an admin command prompt. That fixes file system corruption that can cause log files to keep getting damaged. Also check your RAM: use Windows Memory Diagnostic tool. Bad memory can corrupt files during writes. I've seen that on older servers running 24/7 for years.

Once you clear the log and the error stops, keep an eye on it. If it comes back within a week, you probably have a failing disk or a driver that's spamming the event log with bad writes. Replace the drive or update the driver.