MS People ?? - Odd Event Log Problem

Hi All,

I have just come back from a couple of weeks off work to find my fully
patched and upto date SBS2000 servers' event logs "unreadable". I say
unreadable because when you first open up the event log viewer, all logs
app, system etc are empty, however you can still click and highlight rows in
the MMC display even though there is no information being shown, so
something must be being loaded in to the MMC.

Looking at the .evt files shows that there is information in the actual .evt
files, but for some reason the Event Log MMC cannot view / display their
content.

Any suggestions?

TIA

John

John
Wed Oct 15 04:52:58 CDT 2003

Ok, now I have established that I have got corrupt event logs, ALL of them!!
I have found a MS KB article that tells me how to delete and fix this, so no
problem.

The thing that concerns me now is that, what could have caused this? Bad
disk, hacker wanting to cover their tracks? I could understand one .evt file
becoming corrupt, but all 6 at once??

Any ideas

TIA

John

"John Savidge" <wh@t> wrote in message
news:uVI$xDwkDHA.392@TK2MSFTNGP11.phx.gbl...
> Hi All,
>
> I have just come back from a couple of weeks off work to find my fully
> patched and upto date SBS2000 servers' event logs "unreadable". I say
> unreadable because when you first open up the event log viewer, all logs
> app, system etc are empty, however you can still click and highlight rows
in
> the MMC display even though there is no information being shown, so
> something must be being loaded in to the MMC.
>
> Looking at the .evt files shows that there is information in the actual
.evt
> files, but for some reason the Event Log MMC cannot view / display their
> content.
>
> Any suggestions?
>
> TIA
>
> John
>
>

John
Thu Oct 16 04:02:00 CDT 2003

Anyone???

"John Savidge" <wh@t> wrote in message
news:eTdVoIwkDHA.1488@TK2MSFTNGP12.phx.gbl...
> Ok, now I have established that I have got corrupt event logs, ALL of
them!!
> I have found a MS KB article that tells me how to delete and fix this, so
no
> problem.
>
> The thing that concerns me now is that, what could have caused this? Bad
> disk, hacker wanting to cover their tracks? I could understand one .evt
file
> becoming corrupt, but all 6 at once??
>
> Any ideas
>
> TIA
>
> John
>
> "John Savidge" <wh@t> wrote in message
> news:uVI$xDwkDHA.392@TK2MSFTNGP11.phx.gbl...
> > Hi All,
> >
> > I have just come back from a couple of weeks off work to find my fully
> > patched and upto date SBS2000 servers' event logs "unreadable". I say
> > unreadable because when you first open up the event log viewer, all logs
> > app, system etc are empty, however you can still click and highlight
rows
> in
> > the MMC display even though there is no information being shown, so
> > something must be being loaded in to the MMC.
> >
> > Looking at the .evt files shows that there is information in the actual
> .evt
> > files, but for some reason the Event Log MMC cannot view / display their
> > content.
> >
> > Any suggestions?
> >
> > TIA
> >
> > John
> >
> >
>
>

SuperGumby
Thu Oct 16 08:38:05 CDT 2003

sorry John, I again don't have a solution but wish to console you somewhat
by suggesting that you ain't on your Pat Malone mate. I've seen this happen.

When I've seen it it was immediately after a batch MS WU update. I restarted
the box several times to be confronted with the same lack of logs then I
shutdown, powered off, waited, and powered up, BINGO. Logs were back.

I cannot supply a reason why.

"John Savidge" <wh@t> wrote in message
news:OBHC0Q8kDHA.2272@tk2msftngp13.phx.gbl...
> Anyone???
>
> "John Savidge" <wh@t> wrote in message
> news:eTdVoIwkDHA.1488@TK2MSFTNGP12.phx.gbl...
> > Ok, now I have established that I have got corrupt event logs, ALL of
> them!!
> > I have found a MS KB article that tells me how to delete and fix this,
so
> no
> > problem.
> >
> > The thing that concerns me now is that, what could have caused this? Bad
> > disk, hacker wanting to cover their tracks? I could understand one .evt
> file
> > becoming corrupt, but all 6 at once??
> >
> > Any ideas
> >
> > TIA
> >
> > John
> >
> > "John Savidge" <wh@t> wrote in message
> > news:uVI$xDwkDHA.392@TK2MSFTNGP11.phx.gbl...
> > > Hi All,
> > >
> > > I have just come back from a couple of weeks off work to find my fully
> > > patched and upto date SBS2000 servers' event logs "unreadable". I say
> > > unreadable because when you first open up the event log viewer, all
logs
> > > app, system etc are empty, however you can still click and highlight
> rows
> > in
> > > the MMC display even though there is no information being shown, so
> > > something must be being loaded in to the MMC.
> > >
> > > Looking at the .evt files shows that there is information in the
actual
> > .evt
> > > files, but for some reason the Event Log MMC cannot view / display
their
> > > content.
> > >
> > > Any suggestions?
> > >
> > > TIA
> > >
> > > John
> > >
> > >
> >
> >
>
>

John
Thu Oct 16 09:08:44 CDT 2003

Cheers SG, I'll try a total shutdown over the weekend and see if they come
back.

John

"SuperGumby" <not@public.groups> wrote in message
news:u8wxAr%23kDHA.2068@TK2MSFTNGP09.phx.gbl...
> sorry John, I again don't have a solution but wish to console you somewhat
> by suggesting that you ain't on your Pat Malone mate. I've seen this
happen.
>
> When I've seen it it was immediately after a batch MS WU update. I
restarted
> the box several times to be confronted with the same lack of logs then I
> shutdown, powered off, waited, and powered up, BINGO. Logs were back.
>
> I cannot supply a reason why.
>
> "John Savidge" <wh@t> wrote in message
> news:OBHC0Q8kDHA.2272@tk2msftngp13.phx.gbl...
> > Anyone???
> >
> > "John Savidge" <wh@t> wrote in message
> > news:eTdVoIwkDHA.1488@TK2MSFTNGP12.phx.gbl...
> > > Ok, now I have established that I have got corrupt event logs, ALL of
> > them!!
> > > I have found a MS KB article that tells me how to delete and fix this,
> so
> > no
> > > problem.
> > >
> > > The thing that concerns me now is that, what could have caused this?
Bad
> > > disk, hacker wanting to cover their tracks? I could understand one
.evt
> > file
> > > becoming corrupt, but all 6 at once??
> > >
> > > Any ideas
> > >
> > > TIA
> > >
> > > John
> > >
> > > "John Savidge" <wh@t> wrote in message
> > > news:uVI$xDwkDHA.392@TK2MSFTNGP11.phx.gbl...
> > > > Hi All,
> > > >
> > > > I have just come back from a couple of weeks off work to find my
fully
> > > > patched and upto date SBS2000 servers' event logs "unreadable". I
say
> > > > unreadable because when you first open up the event log viewer, all
> logs
> > > > app, system etc are empty, however you can still click and highlight
> > rows
> > > in
> > > > the MMC display even though there is no information being shown, so
> > > > something must be being loaded in to the MMC.
> > > >
> > > > Looking at the .evt files shows that there is information in the
> actual
> > > .evt
> > > > files, but for some reason the Event Log MMC cannot view / display
> their
> > > > content.
> > > >
> > > > Any suggestions?
> > > >
> > > > TIA
> > > >
> > > > John
> > > >
> > > >
> > >
> > >
> >
> >
>
>