Fix ERROR_LOG_METADATA_INVALID (0x000019D5) on Windows Server

Quick answer: Run wevtutil el | % { wevtutil cl $_ } in an elevated PowerShell to clear all event logs, then restart the Event Log service.

What's actually happening here?

This error appears when the Windows Event Log service tries to access a metadata file — like %SystemRoot%\System32\winevt\Logs\*.evtx — and the file's internal structure doesn't match what the log file system expects. The metadata file can't be created or parsed, so the service throws error 0x000019D5 (ERROR_LOG_METADATA_INVALID).

I've seen this on Windows Server 2016, 2019, and 2022 mostly after a sudden power loss, a disk that ran out of space, or when a backup tool locks the log files mid-write. The metadata header gets corrupted, and the log service can't recover gracefully on its own.

The real fix is to clear the corrupted log files and let the service rebuild them. Don't try to repair individual logs — it's faster and more reliable to nuke the lot and start fresh.

Fix steps

1. Stop the Event Log service to prevent writes while we work.
   Run in an elevated Command Prompt or PowerShell:
   net stop eventlog
2. Back up existing logs if you need them for auditing. Copy the folder C:\Windows\System32\winevt\Logs to a safe location. Most people skip this step, but if you have compliance requirements, don't skip it.
3. Clear all logs using wevtutil. This is the nuclear option. It deletes all entries but keeps the log files themselves. Run in an elevated PowerShell:
   wevtutil el | % { wevtutil cl $_ }
   The reason this works: wevtutil el lists every channel name, and wevtutil cl clears each one. The metadata file gets reinitialized to a valid state.
4. Restart the Event Log service so it picks up the fresh metadata:
   net start eventlog
5. Verify the error is gone. Open Event Viewer and check if logs populate normally. You can also run wevtutil qe System /c:1 to see if the system log returns events.

Alternative fixes if the main one fails

If the log service still won't start after clearing logs, the metadata files might be physically damaged on disk. Here's what to try:

• Delete the log files directly — stop the service, delete everything in C:\Windows\System32\winevt\Logs, then start the service. The service recreates the files with default metadata. This is more aggressive than wevtutil cl because it removes the files entirely instead of just clearing contents.
• Run SFC and DISM to rule out corruption in the system files. In an elevated CMD:
  sfc /scannow then dism /online /cleanup-image /restorehealth. This isn't specific to this error, but I've seen corrupted wevtapi.dll cause similar metadata issues.
• Check disk integrity — run chkdsk c: /f and reboot. Bad sectors on the drive can corrupt log metadata silently.

Prevention tip

Set a maximum log size per channel in Event Viewer (right-click a log → Properties → change log size). I set System and Application logs to 20 MB max with "Overwrite events as needed" enabled. This prevents the metadata from ballooning into a corrupt state when the disk fills up. Also, never let your System drive drop below 1 GB free — the log service doesn't handle low space gracefully.

If you're running Veeam or another backup tool that snapshots event logs, disable log truncation during backup jobs. Had a client whose Veeam job kept locking the .evtx files mid-write, causing this exact error every Sunday morning.