Fixing ERROR_LOG_FILE_FULL (0X000005DE) on Windows
Your event log is full and can't write new entries. Here's how to clear the log and prevent it from filling up again.
Quick answer: Open Event Viewer eventvwr.msc, right-click each log (Application, Security, System) and select Clear Log.
Here's the deal. Had a client last month whose entire print queue died because of this. The event log on their server filled up with print job entries, and new events couldn't write. Windows just stopped logging anything useful. The error 0X000005DE means the event log file hit its max size—default is 20MB per log in most Windows versions. On a busy system, especially a domain controller or server with lots of services, that fills up fast. The fix is straightforward, but you also need to stop it from happening again.
Step-by-step fix
- Open Event Viewer. Press Win + R, type
eventvwr.msc, hit Enter. - Expand Windows Logs in the left pane. You'll see Application, Security, Setup, System, and Forwarded Events. The error typically appears on Application or System.
- Clear each log. Right-click on Application, choose Clear Log. You'll be asked to save—I usually say no unless you're troubleshooting something specific. Repeat for Security and System.
- Set log size limits so this doesn't happen again. Right-click each log, go to Properties. Change the Maximum log size to something sensible—1024 MB is good for most systems. Then check Overwrite events as needed. That tells Windows to delete old entries when the log hits the limit instead of stopping.
- Restart the Event Log service to apply changes. Open Command Prompt as admin, run:
net stop EventLog && net start EventLog. Alternatively, just reboot—that works too.
Alternative fix if Event Viewer won't open
Sometimes the log is so full that Event Viewer itself crashes. Been there.
- Use PowerShell. Open PowerShell as admin, run
Clear-EventLog -LogName Application, Security, System. This clears all three logs at once. - Delete the log files manually. Stop the Event Log service, delete the .evtx files in
C:\Windows\System32\winevt\Logs, then restart the service. Be careful—if you delete the wrong file, you're restoring from backup.
Prevention tip for busy systems
Set a scheduled task that clears logs weekly. I do this for all my clients' servers. Create a basic task that runs wevtutil el | ForEach-Object { wevtutil cl $_ } every Sunday night. That clears all logs and keeps them lean. Also review what's generating the logs—misconfigured services can flood the log. Had a client whose DNS server was logging every query. That's not normal. Turn off verbose logging where it's not needed.
One more thing: if you're on Windows Server, check the Forwarded Events log too. That one can balloon if you're collecting from multiple machines. Set its size to match.
Was this solution helpful?