Fix ERROR_LOG_ARCHIVE_IN_PROGRESS (0X000019E9) on Windows

Quick answer for advanced users: Stop the Windows Event Log service, delete or rename the archived log file, then restart the service.

What this error means

You get ERROR_LOG_ARCHIVE_IN_PROGRESS (0X000019E9) when your Windows Event Log service is already writing an archive — but can't finish. Maybe the archive file is locked, the disk is full, or a previous archive got corrupted. I've seen this happen most often on Windows Server 2016 or 2019 after a scheduled archive task runs, then fails mid-way. The service stays stuck, and new log entries just bounce back with this code.

This tripped me up the first time too. The error is rare, but when it hits, you can't write any new events until the archive either completes or is killed. Let's fix that.

Fix steps

1. Open Services — Press Win + R, type services.msc, hit Enter. Find Windows Event Log. Right-click and select Stop. The service will stop immediately — don't worry, it won't break anything.
2. Find the archive file — The archive is usually in C:\Windows\System32\winevt\Logs\. Look for files like Archive-Security-YYYY-MM-DD-.... Sort by date modified. The most recent one is the stuck archive.
3. Delete or rename it — Right-click the archive file, rename it to something like Archive-Security-old.evtx. Or delete it if you're sure you don't need it. You might need to take ownership first: right-click > Properties > Security > Advanced > Change owner to your admin account.
4. Restart the service — Go back to Services, right-click Windows Event Log and select Start. The error should be gone. Open Event Viewer (eventvwr.msc) and check if new logs appear.

Alternative fixes if the main one fails

If stopping the service doesn't work or you can't find the archive file, try these:

• Increase disk space — Log archiving needs free disk space. If your drive has less than 5% free, the archive might hang. Delete temp files with Disk Cleanup (cleanmgr.exe).
• Reset the Event Log service configuration — Open Command Prompt as admin. Run wevtutil el to list all logs. Then run wevtutil cl System to clear the System log. That forces a clean state. Replace "System" with the log name that's stuck (like "Security" or "Application").
• Check for a stuck backup process — Some backup software (like Veeam or Windows Server Backup) locks log files during backup. Check Task Manager for any backup-related processes and end them.
• Reboot in Safe Mode — If nothing works, boot into Safe Mode (press F8 during startup or use Settings > Recovery > Advanced startup). Then repeat the main fix. Safe Mode loads fewer services, so the archive might release.

Prevention tip

To stop this from happening again, adjust your Event Log size settings. Open Event Viewer. Right-click a log (like Windows Logs > Application) and select Properties. Set the max log size to something reasonable — 20 MB for small servers, 100 MB for busy ones. Also check Archive the log when full, don't overwrite events? If you don't need archives, switch to Overwrite events as needed. That stops the service from archiving altogether. On Windows Server, I'd also schedule a weekly reboot to clear any stuck archive processes.

I once had a customer whose archive was stuck for 3 days — they couldn't see any new login failures. After we killed the archive file, everything worked. Don't wait that long. If the error shows, fix it within minutes.