Fix ERROR_EVT_INVALID_CHANNEL_PATH (0X00003A98) on Windows

Quick Answer

Open an elevated Command Prompt and run wevtutil gl "Application" — if that fails, delete the registry key at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application and restart the Event Log service.

Why This Happens

Event Viewer stores logs in .evtx files under C:\Windows\System32\winevt\Logs. Each log has a corresponding registry key under HKLM\SYSTEM\CurrentControlSet\Services\EventLog. Error 0X00003A98 means Windows tried to read a log file or registry entry that doesn't match the expected format. I've seen this most often after a failed Windows Update, a sudden power loss, or a third-party tool that mucks with the Event Log service.

The culprit here is almost always one of two things: a corrupt .evtx file that Windows can't parse, or a registry entry pointing to a channel that no longer exists. Don't bother reinstalling Windows — that's like burning down the house to fix a leaky faucet.

Step-by-Step Fix

Identify the broken channel — Open Event Viewer. The error message usually shows the channel name (e.g., "System", "Application", or a custom log). If you can't open Event Viewer, check the system event log via PowerShell: Get-WinEvent -ListLog * | Where-Object {$_.IsEnabled -eq $true}. Look for any log with an error state.
Run wevtutil to test — Open Command Prompt as Administrator and run wevtutil gl "LogName". Replace LogName with the channel name from step 1. If you get error 0X00003A98, the channel is broken.
```
wevtutil gl "Application"
```
Back up the log file — Before you nuke anything, copy the .evtx file from C:\Windows\System32\winevt\Logs to a safe spot. For example, copy "C:\Windows\System32\winevt\Logs\Application.evtx" "C:\Backup\".
Clear the log via wevtutil — Try clearing it: wevtutil cl "LogName". If that works, you're done. If it fails, move to the registry fix.
Delete the registry key — Open Regedit as Administrator. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog. Find the subkey matching your broken channel (e.g., Application, System). Right-click and delete it. This sounds scary, but the Event Log service recreates it on restart with default values.
```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application
```
Warning: Don't delete the entire EventLog key — only the specific subkey for the broken channel.
Restart the Event Log service — Open Services.msc, find Windows Event Log, right-click and select Restart. Or from an admin command prompt: net stop EventLog && net start EventLog. This will also bounce any services that depend on it, like the Windows Time service.
Verify the fix — Open Event Viewer and check the channel. It should show a clean log with a message that the log was cleared. Run wevtutil gl "LogName" again — it should return the channel properties without an error.

Alternative Fixes

If the registry delete didn't work, try these:

Replace the .evtx file — If you have a backup from another working machine (same OS version), copy the .evtx file to C:\Windows\System32\winevt\Logs. Make sure to stop the Event Log service first, or you'll get a file-in-use error.
Use PowerShell to re-register the log — New-WinEventLog -LogName "CustomLog" -FilePath "C:\Windows\System32\winevt\Logs\CustomLog.evtx". This creates a fresh log file and registry entry in one go. Works for custom logs but not for built-in ones like System or Security — those are protected.
Run SFC and DISM — If the Event Log service itself is corrupt, run sfc /scannow followed by DISM /Online /Cleanup-Image /RestoreHealth. This fixes underlying system file corruption that might cause the channel path issue. I've seen this resolve the error when the wevtapi.dll is damaged.

Prevention

Set a reasonable log size limit. By default, Windows 10 sets Application logs to 20 MB. If you have verbose logging enabled, increase it to 50 MB or 100 MB. Logs that fill up to disk capacity often corrupt. Also, run wevtutil sl "Application" /ms:20971520 to limit size to 20 MB. And always shut down Windows properly — power cuts are the #1 cause of .evtx corruption.