You're running a Windows Server 2019 or 2022 box, patched up to date, when suddenly the Event Viewer shows error 0X000019D1 – ERROR_LOG_BLOCK_INVALID. The server feels sluggish, maybe applications crash, or you see a BSOD with that code. This error almost always happens after a dirty shutdown (power loss, forced restart) or a disk that's degrading. I've seen it on older Dell PowerEdge servers with SATA drives that had bad sectors.
The root cause is simple: the log service (event log, system log, or application log) found a block of data that doesn't match its checksum. It's like reading a book where a page is torn and the story doesn't make sense. Windows tries to read that block, fails, and throws the error. It's not a virus or driver issue – it's corruption.
Step 1: Backup and check disk health
Before you touch any logs, run a disk check. A bad disk can cause repeated corruption. Open Command Prompt as Administrator and run:
chkdsk C: /f /rReplace C: with your system drive. This scans for bad sectors and fixes file system errors. It'll ask to schedule on next reboot – type Y and restart. Let it finish. If chkdsk finds errors, consider replacing the drive soon.
Step 2: Clear the corrupt log
The error tells you which log file is bad. Look in Event Viewer under Windows Logs – Application, System, Security. Find the event with ID 0X000019D1. It usually says which log (e.g., "System"). You'll clear that log with wevtutil. Here's how:
- Open Command Prompt as Administrator.
- Type
wevtutil elto list all logs. Find the one with the error (e.g.,System). - Type:
wevtutil cl System(replace System with the exact log name).
This command clears the log. It doesn't delete the log file – it just empties it. The service will create a new, clean block. Wait 30 seconds, then restart the Event Log service:
net stop eventlog && net start eventlogStep 3: Re-register the log if clearing fails
If wevtutil gives an error like The log is corrupt, you need to re-register the log. This is more aggressive – it deletes the log file and recreates it. Do this for system logs only (System, Application, Security). For each corrupt log, run:
wevtutil um System.evtx
wevtutil im System.evtxBut first, you need the original .evtx file path. They live in C:\Windows\System32\winevt\Logs. For example, for the System log, run:
wevtutil um "C:\Windows\System32\winevt\Logs\System.evtx"
wevtutil im "C:\Windows\System32\winevt\Logs\System.evtx"This unregisters and then re-registers the log. The service creates a fresh file. Restart the event log service after.
Step 4: Check for disk controller issues
If the error comes back after clearing, you might have a failing disk controller or a corrupt NTFS volume. Run sfc /scannow to check system files, but that's rarely the fix here. More often, it's hardware. Check your server's storage controller logs (like Dell iDRAC or HP iLO) for disk errors. Also try:
fsutil dirty query C:If it says Dirty, the drive needs a chkdsk at boot. That's a sign of deeper corruption.
What if it still fails?
If the error keeps coming back after steps 1–3, stop treating it as a log problem. It's now a hardware problem. Check the disk's SMART status with wmic diskdrive get status – if it says Bad, replace the disk. Also check if the server's RAID battery is dead – that can cause write cache corruption, which corrupts log blocks. On a VM, check the host's disk health. I've seen this error on Hyper-V VMs where the host had a faulty SSD. Fix the underlying storage, and the log error disappears. If you still see it after a clean disk, reinstall the event log service via DISM: dism /online /cleanup-image /restorehealth. But honestly, in my 6 years running a help desk, 90% of the time clearing the log works. The other 10% – new disk time.