The Eventlog service on my XP x64 system will not start, either manually or automatically. You can not access the various logs via Event Viewer either. This is a dual boot XP32/64 machine, and the 32 bit OS has no such problems. Here are some things tried to date:
1) In Component Services, clicking the START button for Event Log generates the error message "Could not start the Event Log service on Local Computer. Error 2: The system cannot find the file specified."
2) Trying to read the logs via the Event Viewer generates the error message "Unable to complete the operation on 'Application'. The interface is unknown." In the Event Viewer on the right pane, it says "There are no items to show in this view". This is true for all the logs. The logs are clearly visible when you look for them in Windows Explorer.
3)Drilling down through MyComputer to the Error Reporting window shows error reporting as enabled, and both Windows and Programs checked.
4) Deleting the existing log files had no impact on the problem. They were not automically generated as they should have been
5) Running sfc /purgecache and sfc /scannow reported no errors
6) Rolling back to an earlier date via System Restore had no effect
7) Last but not least, a Repair Install of x64 had no effect.
8) The windows\system32\config folder has full access rights for both System and Adminstrator (the only way to log on).
Any suggestions or tips? Thanks.
Did you upgrade to service pack 3 recently?
Let's see if this will work:
Start > Run > type in:
services.msc > OK
Now scroll down to Event Viewer.
Double Click on it and make the Startup type Automatic from the drop down
box and click on the Start button to start the service.
Click Apply.
Click OK.
Try opening event viewer again…
How did that work?
Windows XP x64 is only up to SP2, there is no SP3 for it yet.
Items 1 and 2 in the original post describe what happens when accessing and trying to start Even Log and Event Viewer.
Have you tried checking for malware? Start a new topic in the malware forum and let me know what they say. We need to know if malware causes this problem.
In the meantime, have both topics set up and we can work here while you work there with a trusted helper.
– Go to Start…Run…and type in "cmd" (without the quotes) and press Enter. In the black window that opens, type in the complete path to the fix_registry_permissions.bat file (including the filename) and press Enter repair the registry permissions.
1) Yup, have spent too much time trying to fix the problem, and have posted it on even more boards than you have found, with no real answer(s) yet. Am working with someone at Microsoft (or more likely, a computer) that keeps throwing KB articles out at me, with no fix in sight.
2) I can only log into x64 as an Adminstrator, and as far as I know, the relevant folders, subfolders and files all have full access rights for Adminstrator, Adminstrators, and System.
3) This is my personal PC at home, will try your suggested test on System Information, batch files, etc. when I get home tonight (3 hours from now).
4) Have already done a Repair Install, no fix. I was just talking with an IT friend today about the possibility of wiping the partition and reinstalling from scratch, just time consuming and most of my 64 bit programs are high end Autodesk applications with really funky install routines. I am hesitant to do that, since the Repair Install did not fix anything. He did bring up an interesting alternative - installing Virtual PC and then installing another copy of x64 within Virtual PC to see if the problem occurs again. I'd be more likely to try that before doing a fully clean reinstall again, which would take over half a day or more.
5) Originally I was under the impression that x64 was "immune" from viruses and malware, since it is a 64 bit operating system (which I realize that it is not). Just used Avast for antivirus, no malware programs for the one year period that it has been running. I had also been running Kaspersky, Spybot and Malaware (spelling?) under the 32 bit OS (remember this is a dual boot 32/64 bit system) every week, checking both 32 bit and 64 bit partitions. But last weekend I did blow away Avast on x64, installed Kaspersky and Spybot, ran both in normal mode, and then in safe mode. Spybot found a bunch of adware stuff, but nothing serious. Kaspersky found dozens of things, but it said it "neutralized" them all (quarrantined in lieu of deleting I think) . My Google search for 64 bit and virus and malware did not turn up anything that specified anything that would attack services.exe or the Event Logger, but then again…..
This all came about a couple of weeks ago when I tried to install the 64 bit version of another Autodesk program, and it would not install because the Event Logger would not start. I have no idea how long the Event Logger has been disabled other than the original logs (before I blew them away) were dated in July of 2008, with no log file having a date beyond that. And once again, the 32 bit version OS has no problems at all. The only other potentially relevant thing was that I used a registery cleaner sometime last year that was not set up for x64, and messed up the registry, but restored it without a problem.
The most mysterious thing to me is that the services will not automatically regenerate the log files once you blow them away (which is easy to do on a dual boot machine, just do it while in the 32 bit OS). Makes me wonder if there is either a bad file or malware doing this (although there apparently is no other obvious problems either with the OS or the running programs).
In any case, I greatly appreciate your offer of help, as you can see from the other posts that most other boards and forums are happily side stepping my problem. And not that it matters much, but the PC is my home unit, and I am on East coast time, usually can work with it between 6 - 10 PM eastern and on weekends, so there may be some delay in my responses.
Since your trial of installing another autodesk occurred, with the event logger error…it looks like your other Autodesk applications are tying up the event logger. It is rather confusing to the event logger that many autodesk applications are installed at once. The event logger will only work with one autodesk…after more than one are installed, the event logger gets confused. So it stops the service. It keeps the service stopped due to DEP (Data execution prevention). Even if you turn off DEP, you will probably still have a tied up event logger.
A reformat and reinstall will not work. It does not matter at this point for this error, unless if you are willing to give up the more than one autodesk. If my computer was strong enough, I would run autodesking on four simple systems. That breaks down to a dual boot system, one 32 bit and one 64 bit…then I would run virtual machines on each of them. 4 simple systems, and 4 autodesks.
The reason to limit how many autodesks used is because it messes with the compatibility matrix in Windows XP x64.
Pick which one you want. I am sure you want all of the autodesks. Never worry, the event viewer is optional in Windows. If it were a big deal, then there would be a fix for it, correct?
As long as you stay updated with Windows Updates, and do safe browsing habits, your computer will stay in top shape.
Other than that…this issue is solved. If you think you might have malware, head over to the malware forums and read the pinned topiics…then start a new topic requesting help.
Well, I disagree with the conclusion that "this issue is solved". Here are results as of today:
* System information is working just fine.
* Windows Management Instrumentation is enabled and running, the login is to the local system account.
* WMI Performance Adapter is stopped and marked as manual start only.
* Running the "restore security settings" via KB 313222 had no effect.
* Resetting the registry permissions could not be tried, the link posted is reported as bad, can you provide again?
* The next item, SubinACL utility link is also reported as bad, can you provide again?
* For the next section, can not run as I could not download subinacl; also the first line of the batch file refers to the windows resource kits tools, I am relatively sure
that Microsoft never released a Windows Resource Kit for the x64 system, but I could be wrong.
* With regards to kb article 279754, eventlog.dll is in the \windows\system32\ folder; x64 does not have a dllcache folder (or at least I don't)
=================================
AUTODESK PROGRAMS AND X64:
=================================
Actually, I have only the following Autodesk products installed as 64 bit applications: Mudbox 2009, MotionBuilder 2009, 3DS Max 2009, Combusion 2008 and Cleaner XL. The program that uses a "network license" to run under 64 bit (but not 32 bit, heaven knows why) is Toxik 2009 and it will not run; uninstalling it does not fix the problem. I also have Autocad 2006, which works fine
Your response: "Since your trial of installing another autodesk occurred, with the event logger error…it looks like your other Autodesk applications are tying up the event logger. It is rather confusing to the event logger that many autodesk applications are installed at once. The event logger will only work with one autodesk…after more than one are installed, the event logger gets confused. So it stops the service. It keeps the service stopped due to DEP (Data execution prevention). Even if you turn off DEP, you will probably still have a tied up event logger.
A reformat and reinstall will not work. It does not matter at this point for this error, unless if you are willing to give up the more than one autodesk. If my computer was strong enough, I would run autodesking on four simple systems. That breaks down to a dual boot system, one 32 bit and one 64 bit…then I would run virtual machines on each of them. 4 simple systems, and 4 autodesks.
The reason to limit how many autodesks used is because it messes with the compatibility matrix in Windows XP x64.
Pick which one you want. I am sure you want all of the autodesks. Never worry, the event viewer is optional in Windows. If it were a big deal, then there would be a fix for it, correct?"
I'd like to see some references on your position that the event logger can only handle installation of one autodesk program. It is my understanding that the logs can be set to over-write, and I don't see installation of more than one Autodesk product as causing a problem, perhaps you could elaborate. That would be a very limiting sales impact on the folks at Autodesk if they had written programs that disturb the event logger. I have five programs (six counting Autocad 2006) that run just fine.
Pardon perhaps a simplistic idea to such a complex issue but have you tried the "built-in" admin account or created another admin account to see if the issue persists across accounts?
What I was saying more or less…is that Autodesk tools use the event logger. They use the event logger to make sure Windows is running smoothly. If they see errors, then Autodesks may slow down to allow the issues to be resolved. It is all about performance, compatibility, and reliability.
It is a compatibility bug on each manufacturer that is impossible to fix at this point, that more than one shouldn't be installed because they would tie up the event logger.
Like I said, if it were a big deal, then there would be a fix for it, correct?
The big thing to realize is that compatibility for Windows 64 bit applications is rough, and still developing. From time to time, applications will fail to perform at their best and may do things, such as disable a certain service, modify the registry, or even delete a system file if they are not functioning properly.
If you want me to go on, I would ask you next to get a driverquery log, so I may view drivers on your system and see if they interfere with each other.
Thanks for all of your help. I recognize that this is somewhat "bleeding edge", and that x64 is considered by some to be an orphan product. In fact, if I do commit to an OS rebuild, I probably will replace XP x64 with Vista 64 (maybe not such an improvement?). Just wanted to avoid the 1/2 - 1 day for an OS and program reinstall and update, but it is quickly turning into the path of least resistance.
Autodesk has promised a 'hotfix' for over a month, but has failed to deliver to date. Fundamentally I think I have an orphan product (Toxik 2009 64) on an orphan OS (x64), and will either resolve problem this week or redo OS.
Where do I get the necessary program to do a driverquery log?
I can upload it. All you need to do is download the zip, unzip it. The zip is called driverbose. I basically have put together a tool that allows the Windows command DRIVERQUERY (-v) to run, then post a log.
Run that tool and it will save a log. Post the contents of that log in to your next reply. When you post it, I will research the entries and help distinguish which drivers are interfering with each other. The results of this test may or may not help.
I have sucessfully created a new partition, and installed another copy of x64 on the partition, and the Event Log and other services are working fine - so far. I plan to install drivers, updates and software SLOWLY with restore points, and try to see what change/software might cause the Event Log service to stop for the new copy of x64. If I determine the cause, will post results up here.
If the problem does not occur with the new OS, then will migrate software and files to new partition, then wipe and reabsorb into the new partition.
Many thanks to all for your input, but after a couple of weeks, this is the path of least resistance.
I am glad to hear that. Make sure that you create a restore point before each install. Be sure to test your event log and anything else that went wrong, before proceeding.
That's what I am doing. So far, so good. Will be reinstalling the sotware, starting with the "problem" software first, and will see if anything causes the event log to stop again.
Hopefully it will not, and then I can wipe the original partition and then absorb it into the new partition. Thanks once again for everyone's input, much more valuable than virtually all other sites (and I have listed on dozens).
General advice to others with a non-working Event Log and/or Event Viewer: just bite the bullet and redo the operating system from scratch.
Thanks once again for everyone's input, much more valuable than virtually all other sites (and I have listed on dozens).
I really do appreciate that comment. I am sure WhatTheTech members do as well. If you have anymore questions, this topic will be open for you to ask them freely.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
