STATUS_LOG_READ_MODE_INVALID (0XC01A000B) Fix
Happens when reading a Windows log with an invalid mode flag. Usually triggered by a corrupt log file or custom reader passing bad parameters.
When does this error show up?
You'll see STATUS_LOG_READ_MODE_INVALID (0XC01A000B) when code tries to read a Windows log file—usually an event log or a Common Log File System (CLFS) base log—but passes an invalid read mode to the ReadLog API. Common triggers are custom backup tools, log analyzers, or recovery scripts that blindly call ReadLog without checking the log's state. It also pops up if the log's internal metadata gets corrupted, making the system reject any read mode as invalid.
What's actually happening here?
The Windows CLFS stack expects one of two read modes: CLFS_LOG_READ_MODE_PINNED or CLFS_LOG_READ_MODE_SEQUENTIAL. These are defined in the SDK headers. The error code 0XC01A000B translates to STATUS_LOG_READ_MODE_INVALID, which means the ReadLog call supplied a mode value that the underlying driver didn't recognize. In normal operation, a reader opens the log with CreateLogReadContext, which sets the mode properly. If the log's control block is damaged—say, from an unexpected shutdown or disk write failure—the stored mode bits can get flipped. The driver then rejects every read attempt because the persisted mode doesn't match either valid constant. This is different from a simple access denied; it's a structural inconsistency inside the log file itself.
The fix — step by step
Step 1: Confirm it's not your code
If you're writing a log reader, double-check you're not passing garbage to ReadLog. The mode parameter should be one of the two valid constants. Old code sometimes uses a hardcoded value like 2, which was valid in early CLFS prototypes but isn't supported anymore. Review your CLFS_LOG_READ_MODE definition. If you're using wevtutil or PowerShell cmdlets and see this error, skip to step 2.
Step 2: Identify the corrupt log
Run wevtutil el to list all event logs. Look for any log with a non-zero last write time or file size that seems off—especially system, application, or security logs. Corrupt logs often have sizes that don't align to 64KB boundaries because CLFS uses fixed-size containers. Use wevtutil gl <logname> to get log metadata. If the status field shows anything other than Active, that log is corrupt.
Step 3: Clear the corrupt log
Open PowerShell as Administrator. Run:
wevtutil cl <logname>Replace <logname> with the affected log, e.g., wevtutil cl Application. This clears the log and reinitializes the CLFS base log file. The reason step 3 works is that wevtutil cl doesn't just delete entries—it rebuilds the underlying CLFS control block with fresh metadata, which resets the invalid mode bits. If wevtutil cl fails with an access error, the log is being held open by another process. Find the process with handle.exe from Sysinternals:
handle -a -p * | findstr "\.log"Kill the process, then retry the clear command.
Step 4: Restart the Windows Event Log service
Even after clearing the log, the old CLFS handle might be cached. Restart the service:
net stop EventLog && net start EventLogThis forces the service to discard any stale log contexts. Now test your reader again. If the error is gone, you're done.
What if it still fails?
If the error persists, the corruption might be deeper—possibly in the CLFS container itself, not just the base log. Locate the log file on disk (usually C:\Windows\System32\winevt\Logs\*.evtx). Run chkdsk /f on the volume to fix file system errors that could have caused the bit corruption. Next, check for antivirus software that holds exclusive locks on EVTX files. Temporarily disable real-time scanning for the Logs folder and retry. If nothing works, export all other logs with wevtutil epl and then rename the entire Logs folder to force Windows to recreate it from scratch. Renaming will cause all existing logs to be lost, so only do this as a last resort on a test machine.
For custom log readers that aren't targeting event logs: review your CLFS initialization sequence. Make sure you call CreateLogReadContext with the correct mode parameter before any ReadLog call. If you're using CLFS_LOG_READ_MODE_PINNED but the log isn't pinned (no record was written yet), the driver may also return this error. Always check the return value of CreateLogReadContext with GetLastError.
Was this solution helpful?