STATUS_LOG_NOT_ENOUGH_CONTAINERS (0XC01A0023) fix

When this error hits

You're working with a Common Log File System (CLFS) log — maybe using Log Parser, reading an Event Tracing log, or running a tool that reads .blf or .log files — and you get this:

STATUS_LOG_NOT_ENOUGH_CONTAINERS (0XC01A0023)
The log must have at least two containers before it can be read from or written to.

I've seen this most often when someone creates a CLFS log programmatically but forgets to add containers, or when a log gets corrupted during a system crash and loses all but one container. It also pops up when you try to attach to a log that was never fully initialized.

What's actually happening

CLFS logs aren't single files — they're made of a base log file (.blf) and one or more container files (usually .log, .blf siblings, or dedicated container files). The base file stores metadata, and containers store actual log records. The CLFS driver requires at least two containers because it uses one as the active write target and the other for safe flushing. With only one container, the driver can't guarantee consistency — it can't atomically switch between containers during a flush operation.

The 0XC01A0023 error is the CLFS way of saying: "I have nowhere safe to write, so I'm not doing anything."

The fix: add a second container

There's no GUI tool for this. You need to use the CLFS API directly, either via the clfsw32.dll functions or a command-line tool. I'll give you the reliable method using the built-in LogCreate and LogAddContainer functions via a small C program. If you don't write C, skip to step 4 — there's a PowerShell workaround.

1. Identify the log
   Run this to find the exact path of your CLFS log. Common locations:
   C:\Windows\System32\winevt\Logs\ for Event Logs
   C:\Windows\System32\config\ for system logs
   C:\ProgramData\ for app-specific logs
2. Create a small C utility
   Compile this with Visual Studio or MinGW. It adds one more container to the existing log:

#include <windows.h>
#include <clfsw32.h>
#include <stdio.h>

int main() {
    HANDLE hLog;
    CLFS_LOG_NAME_INFORMATION logName;
    wchar_t logPath[] = L"C:\\path\\to\\your\\log.blf";
    
    hLog = CreateLogFile(logPath, GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE,
                         NULL, OPEN_EXISTING, 0);
    if (hLog == INVALID_HANDLE_VALUE) {
        printf("CreateLogFile failed: %u\n", GetLastError());
        return 1;
    }
    
    if (!AddLogContainer(hLog, NULL, NULL, NULL)) {
        printf("AddLogContainer failed: %u\n", GetLastError());
        CloseHandle(hLog);
        return 1;
    }
    
    printf("Container added.\n");
    CloseHandle(hLog);
    return 0;
}

Replace logPath with your actual log path. Run it as Administrator. This won't delete any data — it just adds a new container to an existing log.

$logPath = "C:\path\to\your\log.blf"
$logHandle = [Microsoft.Win32.SafeHandles.SafeFileHandle]::new(
    [System.Runtime.InteropServices.Marshal]::AllocHGlobal(0), $false)
# This is simplified — full P/Invoke is verbose. I recommend the C route instead.

Honestly, the C approach is more reliable. The P/Invoke signatures for CLFS are a pain to get right.

#include <windows.h>
#include <clfsw32.h>
// Query log statistics via GetLogFileInformation

Or just try reading the log again with your original tool. If the error's gone, you're good.

If it still fails

Three things to check:

• Permissions: Your process must have write access to the log file and its directory. Run as Administrator.
• Log is not in use: CLFS locks logs while they're mounted. Stop any service or tool using that log (Event Log service, for example) before modifying containers.
• Corrupted base file: If AddLogContainer fails with ERROR_FILE_CORRUPT (1392), the base log metadata is damaged. Then you need to recreate the log entirely — no way around it. Use CreateLogFile with CREATE_ALWAYS, then add your two containers.

That's it. Two containers minimum — always has been, always will be for CLFS. The fix is adding one.