Fix STATUS_EVENTLOG_FILE_CORRUPT (0XC000018E) in Windows

Quick answer (for advanced users)

Stop Event Log service, rename %SystemRoot%\System32\winevt\Logs\System.evtx to System.evtx.old, restart the service. Windows recreates the file automatically. If the system locks up, boot from a Windows recovery USB and delete the file from command prompt.

What happened and why

Error 0XC000018E — the Eventlog file is corrupt. I've seen this most often after a hard power loss on an old Dell PowerEdge server running Windows Server 2016. The disk write didn't finish, the log file got half-written, and the Event Viewer driver won't touch it. The machine might boot, but Event Viewer crashes, you can't view logs, and sometimes the system runs slow because the Event Log service keeps trying to parse a broken file. Had a client last month whose entire print queue died because of this — the spooler depends on event log health, go figure.

Fix: rename the corrupt .evtx file

Open an elevated Command Prompt (Run as administrator).
Stop the Event Log service:
```
net stop EventLog
```
If it hangs, use sc stop EventLog or kill it with taskkill — but usually it stops fine.
Navigate to the logs folder:
```
cd %SystemRoot%\System32\winevt\Logs
```
Find the corrupt file. Usually it's System.evtx or Application.evtx. You can check which one is failing by looking at other error logs (if you can open them) or by trial. Rename it:
```
ren System.evtx System.evtx.old
```
Restart the service:
```
net start EventLog
```
Open Event Viewer — it'll show a fresh, empty log. You'll lose old entries, but the system works again.

Alternative fix: delete from recovery environment

If the system won't boot because the Event Log service hangs, you can't stop it. Boot from a Windows installation USB or recovery drive. At the repair screen, open Command Prompt from Troubleshoot > Advanced Options. Find your Windows drive (usually D: in the recovery environment), then:

cd /d D:\Windows\System32\winevt\Logs
del System.evtx

Reboot. Windows will create a new System.evtx when it starts. I've had to do this on a client's Windows 10 machine that blue-screened every time Event Viewer tried to initialize — recovery environment saved the day.

What if the error persists?

If the error comes back immediately, it's not just one log file. The whole winevt\Logs folder might be on a bad disk sector. Run chkdsk /f c: and check your disk health with CrystalDiskInfo or the built-in WMIC command: wmic diskdrive get status. If the disk is failing, replace it and restore from backup. Seen that on an old HP laptop with a dying hard drive — Event Log corruption was the first warning.

Prevention tip

Set a reasonable max log size. By default Windows lets the log grow to 20 MB on older systems and 1 GB on newer ones. If it grows too large, it's more prone to corruption during writes. I set mine to 100 MB for System and Application logs on servers, 20 MB on workstations. In Event Viewer, right-click each log, go to Properties, and set the max size. Also, always shut down properly — hard power-offs are the #1 cause of this error. Use a UPS if you can.