Fix ERROR_LOG_RECORD_NONEXISTENT (0x000019E0) in Windows

When This Error Hits You

You're working on a Windows 10 machine or a Windows Server 2019 box, and suddenly you see this error in the Event Viewer or in a command line tool like wevtutil. Maybe you tried to export a log file, or your system crashed during a power outage. The exact message says ERROR_LOG_RECORD_NONEXISTENT (0x000019E0) — "The log record is not a record in the log file." I know this error is infuriating because it stops you from reading system events that could tell you what went wrong.

This error usually shows up when the event log is corrupted. It can happen after a bad disk sector, a sudden shutdown, or a failed backup. I've seen it most often on systems that ran out of disk space and the log file got truncated.

What's Actually Happening Under the Hood

Windows event logs are stored as binary files with a specific structure. Each record has a header and data. When the OS tries to read a record at a certain position, it checks if the record's signature matches. If it doesn't — because the file got scrambled — you get error 0x000019E0. It's like opening a book and finding the pages are out of order or missing completely.

The root cause is almost always file corruption. This could be from a disk error, a buggy driver that wrote garbage, or a third-party log viewer that messed up the file. In my years running a help desk blog, I saw this most on older Windows Server 2008 R2 boxes that had been patched poorly.

The Fix: Step-by-Step

Don't bother reinstalling Windows or running SFC right away. The real fix targets the corrupted log file directly. Here's what works:

Step 1: Identify the Corrupted Log

Open Event Viewer (eventvwr.msc). Look for the log that's throwing the error — usually System or Application. Right-click it and select Properties. Note the log path (e.g., %SystemRoot%\System32\winevt\Logs\System.evtx).

Step 2: Back Up the Corrupted File

Before doing anything, copy the .evtx file to a safe folder. This won't fix things, but it lets you recover if needed. Use this command in an admin Command Prompt:

copy "%SystemRoot%\System32\winevt\Logs\System.evtx" "C:\Backup\System_backup.evtx"

Step 3: Clear the Log Safely

This is the fix that works 9 times out of 10. Run this command as admin:

wevtutil cl System

Replace System with the actual log name (like Application or Security). This wipes the log and creates a fresh one. Old events are gone, but the error disappears.

Step 4: Check Disk Health

Clearing the log only fixes the symptom. If a bad disk caused the corruption, it'll come back. Run a disk check:

chkdsk C: /f

You'll need to restart for this to run. Let it finish. It might find and fix bad sectors.

Step 5: Repair If Clearing Doesn't Help

If clearing the log didn't work (maybe you need the old events), try this trick I learned from a Microsoft engineer: rename the .evtx file and let Windows recreate it. Stop the Windows Event Log service first:

net stop EventLog
rename "%SystemRoot%\System32\winevt\Logs\System.evtx" "System.old"
net start EventLog

Windows creates a fresh log automatically. You can then try to extract events from the old file using a third-party tool like EvtxeCmd if you're brave enough.

What If It Still Fails?

If the error keeps coming back after these steps, check these three things:

• Disk space: Low space on the system drive can corrupt logs. Make sure you have at least 10% free.
• Antivirus: Some aggressive AV software locks log files. Temporarily disable it and see if the error stops.
• Third-party log tools: Tools like Event Log Explorer or Log Parser can corrupt files if they crash mid-write. Uninstall them and test.

I've also seen this on systems with failing RAM. Run mdsched.exe to test your memory. It's rare, but it happens. For most people, step 3 or 5 does the job. Good luck — you'll get through this.