Fix 0X000019D7 ERROR_LOG_RESERVATION_INVALID in Windows Event Log

Quick answer

Restart the Windows Event Log service (EventLog) and if that doesn't clear it, delete and recreate the failing log file with wevtutil cl <logname>.

What's actually happening here

The error 0X000019D7 (which is ERROR_LOG_RESERVATION_INVALID) shows up in the System event log when a process—typically a service or a driver—tries to write an event but messes up the log's reservation space. The Event Log service allocates a chunk of the log file for each write, like a parking spot. If the caller requests a reservation that's too big, too small, or already used, the service throws this error.

I've seen this most often on Windows Server 2016 and 2019 boxes running third-party backup agents or monitoring tools that hook into the Event Log API. Those tools sometimes try to reserve space for a huge custom event, and the arithmetic goes sideways. The log file itself isn't corrupt—the caller is just doing something dumb.

Numbered fix steps

Identify which log is failing. Open Event Viewer (eventvwr.msc), look under Windows Logs. The error event usually names the source log. Note it down—most of the time it's System or Application.
Restart the Event Log service. Open an elevated PowerShell or CMD and run:
```
Stop-Service EventLog -Force
Start-Service EventLog
```
This resets the in-memory reservation state. It's the cheapest fix and often clears the transient error.
Check if the error recurs. If it's gone, you're done. If it reappears within minutes, the offending process is still active. Move to step 4.
Clear the specific log. Use wevtutil to wipe it. Replace System with the actual log name:
```
wevtutil cl System
```
This archives the current log and creates a fresh one. Any pending reservations are discarded. You'll lose historical events, so export them first if you need them: wevtutil epl System C:\backup.evtx.
Disable the culprit if it's a known tool. If the error names a specific service (like AcronisAgent or Veeam), stop that service temporarily. If the error stops, the tool is the problem. Check for updates or a hotfix from the vendor.

Alternative fixes if the main ones fail

Increase the log size. Sometimes the reservation fails because the log is nearly full. Right-click the log in Event Viewer → Properties → set a larger max size (e.g., 64 MB instead of 20 MB). This gives more headroom, though it's a band-aid.
Re-register the Event Log DLLs. In an elevated CMD:
```
regsvr32 /s wevtsvc.dll
regsvr32 /s wevtapi.dll
```
Then restart the service. This only matters if the service itself is misbehaving, which is rare but possible after a bad Windows update.
Check for disk corruption. On older servers, a failing disk can cause weird log write errors. Run chkdsk /f on the system drive (requires reboot) and check the SMART status with vendor tools.

Prevention tip

The real fix is figuring out who's abusing the reservation API. Watch the System log for repeated 0X000019D7 events and note the process ID in the event details. Use tasklist /FI "PID eq <pid>" to name it. Once you know the vendor, apply their latest patch or disable the component that's doing the bad writes. Also, keep your server's Event Log size reasonable—don't let it grow to the max, because that's when these reservation bugs surface most.