When This Error Shows Up
You're scrolling through Windows Event Viewer, trying to figure out why a printer keeps dropping off the network. Then you see it — a yellow warning triangle on a log entry, and clicking it gives you 0X00003AA0: The specified XML text was not well-formed. The error code is a dead giveaway: some event log entry has broken XML, and the parser chokes on it.
This usually happens after a crash, a hard shutdown, or a third-party app that writes garbage into the event log. Had a client last month whose security software corrupted the Security log by writing malformed XML after a blue screen. The event log engine just can't handle that.
Root Cause: Corrupted Event Log Entry
Windows stores event logs as .evtx files. Each log entry is essentially an XML snippet. If a write gets interrupted — say, power loss right when the log flushes — you end up with a partial or malformed XML node. The Event Log service tries to parse it, hits the bad spot, and throws this error. The log isn't completely dead; only the broken entry causes the issue. But because of how Windows indexes logs, you often can't read any entries after the bad one until you clear it.
Fix: Clear the Corrupted Log
The only reliable fix is to clear the affected log. You'll lose the entries in that log, but it's better than staring at an error. Here's how to do it without nuking the whole system.
Step 1: Identify the Corrupted Log
Open Event Viewer (eventvwr.msc). Look in the left pane — the error might be in Windows Logs > Application, System, Security, or even Setup. If you're not sure, check the error details: the Log field in the General tab tells you exactly which log is broken.
Write down the log name. For example: System, Application, Security.
Step 2: Backup the Log (Optional but Smart)
If you might need those entries later, save a copy first. Right-click the log in Event Viewer, select Save All Events As..., and save it as an .evtx file. You can open it later on another machine if needed — but odds are that file has the same glitch.
Step 3: Clear the Log via Command Line
Open Command Prompt as Administrator. Then run:
wevtutil cl <LogName>Replace <LogName> with your actual log name. For example:
wevtutil cl SystemIf the log is huge, this might take a minute. The cl flag clears it completely.
Step 4: Verify the Fix
Go back to Event Viewer, right-click the log, and select Refresh (or hit F5). Try opening any new entry — the error should be gone. If you still see it, the corruption might be in a different log. Repeat the process for each log that shows the error.
Still Failing? Try This
If clearing the log doesn't help, you might have a deeper issue. Run sfc /scannow from an elevated command prompt to check for system file corruption. Then restart the Event Log service:
net stop EventLog
net start EventLogOn some systems — especially older Windows Server 2012 or 2016 — the .evtx file itself can get locked by a stuck handle. Rebooting the machine clears that. Painful, but it works.
Last resort: if the same log keeps corrupting, check disk integrity. Run chkdsk C: /f and reboot. Bad sectors on the drive can corrupt event log writes. Had a client whose hard drive was silently dying — event log corruption was the first symptom. Replaced the drive, problem never came back.
One more thing: if you're using third-party event log monitoring software (like SolarWinds or PRTG), disable it temporarily. I've seen those tools read logs aggressively and trigger this error by reading partially written entries.