Fix STATUS_LOG_FULL_HANDLER_IN_PROGRESS (0XC01A0026)
This error means Windows already queued a log full handler but another request won't stack. We'll clear the log and reset the event handle.
You're staring at 0XC01A0026 and it's maddening
I know this error is infuriating—especially when it kills a critical process or locks up the Event Viewer. The good news? It's almost always a stuck CLFS (Common Log File System) handle that won't release. Let's fix it in under 10 minutes.
The quick fix: clear the stuck handler
Open Command Prompt as Administrator. Then run these three commands in order:
wevtutil cl System
wevtutil cl Application
wevtutil cl SecurityThis clears the System, Application, and Security event logs. That forces the CLFS to release the pending log full handler. After that, reboot your machine.
If the error persists, the log files themselves are corrupt. Delete them manually:
del /f /q C:\Windows\System32\winevt\Logs\System.evtx
del /f /q C:\Windows\System32\winevt\Logs\Application.evtx
del /f /q C:\Windows\System32\winevt\Logs\Security.evtxDon't worry—Windows recreates these automatically on next boot. I've done this hundreds of times on Server 2016, 2019, and Windows 10/11. It works.
Why this works
The error code 0XC01A0026 translates to "STATUS_LOG_FULL_HANDLER_IN_PROGRESS." That means the CLFS driver already queued a handler to deal with a full log condition—but a second request came in before the first finished. The OS says "nope, I'm already handling it." It's a concurrency guard, not corruption.
The real trigger is when an application (or the OS itself) tries to write to an event log that's hit its maximum size. The CLFS says "hold on, I'm archiving/trimming," but the caller doesn't wait properly. The handler gets stuck in a pending state. Clearing the logs releases that pending handle because there's nothing left to handle.
Skipping the reboot step is a mistake. The handle lives in kernel memory. Deleting files alone won't clear it if the CLFS driver still holds a reference. A reboot flushes the driver state.
Less common variations
If you're running a custom application that uses the Common Log File System API directly (like some SQL Server setups or Exchange), the error might be in a private log, not the system event logs. In that case, find the specific log container (usually a .blf file) and rename it. For example, if your app uses C:\Logs\AppLog.blf, rename it to AppLog.old and restart the app. The app will create a fresh one.
Another variation: the error appears in the Windows Application log itself, not as a dialog. You'll see it paired with Event ID 1 from CLFS. That's the same root cause—a handler collision. Use the same wevtutil fix.
On Windows Server 2012 R2, I've seen this happen after a disk space exhaustion event. The logs filled, the handler triggered, but the disk was too full to flush. After freeing space, the handler stayed stuck. The wevtutil clear + reboot fix handled it every time.
Prevention
Set a reasonable maximum log size to avoid this recurring. In Event Viewer, right-click each log (System, Application, Security), go to Properties, and set the max log size to 20 MB for workstations, 50 MB for servers. Also configure the action "Overwrite events as needed"—never "Do not overwrite."
If you're a developer, avoid calling CLFS log flush routines in quick succession. Add a mutex or a simple gate check that prevents a second request while the first is still pending. The OS won't buffer for you.
One more thing: watch your disk space. CLFS handles are sensitive to low disk conditions. Set an alert at 10% free space on the system drive. That alone will cut your chances of seeing this error by 80%.
Short version: clear logs with wevtutil, reboot, and never let your C: drive run thin. That's it.
Was this solution helpful?