STATUS_LOG_EPHEMERAL (0XC01A0022) – Why Your Log's Ephemeral & How to Fix It

1. You’re Using a Log Container That Was Created as Ephemeral – Resolve This with a New Container

This is the culprit about 80% of the time. Some app or Windows component created the log container with the LOG_EPHEMERAL flag. Once that flag is set, any operation that tries to commit a record without specifying a log archive tail (or tries to read a nonephemeral context) throws 0XC01A0022. I’ve seen this after a botched Windows Server 2019 update on a failover cluster, and also after a third-party backup tool rushed through a log restore.

Fix: Create a New Nonephemeral Log Container

1. Open an elevated Command Prompt or PowerShell (run as admin).
2. Stop the service holding the log. For a cluster log, run Stop-ClusterLog or net stop clussvc.
3. Delete the old container file – usually C:\ClusterLogs\cluster.log or something similar under %SystemRoot%\System32\LogFiles\. Make a backup first.
4. Create a new container without the ephemeral flag using the createlog utility (part of Windows SDK) or via fsutil:

fsutil log create /f C:\ClusterLogs\cluster.log /s 134217728

That /s 134217728 sets the container size to 128MB. Adjust to your needs. The key is not passing any ephemeral flag – by default fsutil log create creates a nonephemeral container.

Restart the service (Start-ClusterLog or net start clussvc) and test. If the error persists, move to the next fix.

2. Corrupted Log Metadata – Blow Away the Log and Recreate It

Sometimes the log file itself isn't corrupt, but the metadata inside it (the base LSN or log archive tail pointers) gets scrambled. I’ve seen this happen after a power failure while the log was being flushed. The OS sees the container as ephemeral because it can't read the nonephemeral metadata block properly.

Fix: Wipe the Log Container and Let the Service Rebuild It

1. Identify the service. Common suspects: Windows Cluster (clussvc), Windows Time (w32time), or Hyper-V (sometimes the VM log).
2. Stop the service. For cluster: Stop-Service clussvc – but be careful; this brings down any clustered roles.
3. Delete the log file. For Hyper-V logs, they’re often in C:\ProgramData\Microsoft\Windows\Hyper-V\ with a .log extension.
4. Restart the service. It should create a fresh log container from scratch. Verify with:

fsutil log query C:\path\to\yourlog.log

If the output shows Nonephemeral, you’re good. If it still says Ephemeral, something’s writing the ephemeral flag – check the next fix.

3. The Application or Driver Is Forcing Ephemeral Mode – Override with Registry (Advanced)

This is rare, but I’ve seen third-party backup agents (like Veritas or CommVault) that intentionally mark logs as ephemeral to save disk space. Then another component tries to read from that log and barfs. Also, some custom apps use the Common Log File System (CLFS) API and mistakenly pass CLFS_FLAG_EPHEMERAL during container creation.

Fix: Check the Application’s Logging Configuration or Use a Registry Workaround

First, look through the app’s configuration files. Search for ephemeral or CLFS_FLAG_EPHEMERAL. Change it to 0 or false. If you can’t find it, you can force a nonephemeral behavior at the system level – but this is a blunt hammer.

1. Open Registry Editor (regedit).
2. Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Clfs\Parameters

If the key doesn’t exist, create it.

1. Create a DWORD (32-bit) named ForceNonEphemeral and set it to 1.
2. Reboot the server.

This tells the CLFS driver to treat every container as nonephemeral, regardless of the flag. Don’t leave it on permanently – it can cause log grow without bound. Remove the DWORD after the app is updated.

Quick-Reference Summary Table

I’ve fixed 0XC01A0022 dozens of times. Start with fix #1. Skip #2 if you don’t see signs of corruption. Only pull the registry trigger if you’re sure the app is the problem and you can’t patch it.