Yeah, this one's a pain. You're staring at an event log service that won't start, or crashes mid-write, and the error isn't telling you much. Let's cut through it.
The Fix: Restart the Service and Clear the Log Files
Most of the time, the log service is just in a bad state — a crashed process left a lock file or the log file is corrupt. Here's the straightforward sequence that works 80% of the time:
- Open an elevated Command Prompt (right-click → Run as administrator).
- Stop the service:
net stop eventlogIf it won't stop, force it:
taskkill /F /IM svchost.exe /FI "SERVICES eq eventlog"Then rename the log files so the service will recreate them fresh:
cd /d %SystemRoot%\System32\winevt\Logs
ren *.evtx *.oldNow restart the service:
net start eventlogGive it a few seconds, then open Event Viewer (eventvwr.msc). You'll see a fresh set of logs. If the error is gone, you're done.
Why This Works
The event log service keeps a handle to its .evtx files. When a previous instance crashed or was killed improperly, that handle stays locked. The service can't open the file for writing because it thinks it's already in use — that triggers ERROR_LOG_STATE_INVALID.
Renaming the files forces the service to create new ones. The old ones are still there if you need to dig through them later, but they're not in the way anymore. This is the same reason you see this error after a forced shutdown or a power outage — the service didn't get a chance to close cleanly.
Don't bother deleting the files entirely. Renaming is safer because you can always copy them back if you need the history for an audit.
Less Common Variations (when the above doesn't fix it)
Corrupted Registry Values
The event log's configuration lives in the registry under:
HKLM\SYSTEM\CurrentControlSet\Services\EventLogIf the file path in a subkey points to a non-existent location, the service chokes. Compare the File value in each subkey (Application, Security, System, etc.) against the actual file location. A typo there will give you this exact error.
Disk Full or NTFS Corruption
The log service needs to grow those files. If the disk is full, it can't. Check free space first:
fsutil volume diskfree C:If you've got space but still see issues, run a quick chkdsk — not the full scan, just the basic one:
chkdsk C: /fYou'll need to reboot to let it run. I've seen bad sectors on the system drive cause random log service failures that look exactly like this.
Third-Party Log Management Tools
If you've got something like Splunk Universal Forwarder or Winlogbeat installed, they might be holding the log files open. Stop those services first, then try the restart sequence again. They tend to grab exclusive access and don't always release it cleanly.
Prevention
Set the log file sizes to something reasonable so they don't balloon and fill the disk, and set a retention policy. Right-click on a log in Event Viewer → Properties → set maximum size and select "Overwrite events as needed." Do this for Application, System, and Security logs if you're auditing.
Also, always shut down Windows properly. Sounds obvious, but I've fixed this error on machines that were hard-powered off during a thunderstorm and then wouldn't boot into the event log service. A clean shutdown lets the service flush its buffers and release file handles.
And if you're running backups that snapshot the system drive, make sure they're application-aware (VSS). A raw snapshot taken mid-write can leave the log files in a weird state.
That's it. You'll see this error again if you're in a bad environment, but now you know the drill: stop service, rename logs, start service. Ten minutes, no data loss, and you're back in business.