Event Viewer not working in Windows Server

Event Viewer is a handy tool that allows you to view and analyze detailed logs of various events on your computer. It is pretty useful when your system goes through a crash and you are trying to find the reason behind it. However, things can be complicated when Even Viewer itself fails to work. When this happens, you won’t be able to view any event logs and find solutions to fix problems on your Server.

What is Event Viewer in Windows?

Event Viewer is a built-in tool in Windows. It usually stores details of various events on your computer. These events can include system errors, warnings, information messages, and other activities in your Windows environment. It also records events from various sources, such as operating systems, installed applications, hardware components, etc.

Using Event Viewer, one can easily view and analyze the logs to troubleshoot various Windows errors or any other issue on their computer.

Event Viewer not working on Windows Server

If the Event Viewer is not working or opening on your Windows computer, follow these suggestions to resolve the issue:

Restart the Windows Event Log Service
Check & Fix WMI Corruption
Change Retention Details of Log
Run SFC and DISM Scans
System Restore

You will need an administrator account to execute these suggestions.

1] Restart the Windows Event Log Service

There is a good chance that Windows failed to start the Event Log Service properly. Or it is not working correctly for a temporary glitch.

However, restarting the Windows Event Log Service can easily address these issues. To do so, follow these steps:

Press Windows Key + R to launch Run.
Type services.msc and press Enter.
Now search for Windows Event Log and right-click on it and select properties.

Next, a small Window will pop up. From here, first, click on the Stop button to stop the Event log service. Then click on the Start button again.

Once done, click on the OK button to close the menu.
Finally, go ahead and launch Event Viewer and see if it fixes the issue for you.

Read: Fix Windows Services will not start in Windows

2] Check & Fix WMI Corruption

You must also check for WMI corruption and fix it if it’s the culprit. WMI stands for Windows Management Instrumentation, an infrastructure for managing data and operations on Windows operating systems. And in case it is corrupted, it can lead to various issues on your Windows system.

To check and fix any errors, follow these steps:

First, press Windows + X to access the quick menu and select Windows Terminal (Admin).
Now to verify if there is any WMI corruption, run the following command:

winmgmt /verifyrepository

If it returns with an Inconsistent message – it means there is a WMI corruption. If you see a consistent message, it confirms there is no issue with WMI.
To fix this, run the following command:

 winmgmt /salvagerepository

Finally, rerun this command to check if the issue is fixed:

winmgmt /verifyrepository

Read: Event Viewer is missing in Windows

3] Change Retention Details of the Log

In case, Event Viewer is not logging any new data of system crashes or other errors on your PC. Then you can try changing the retention details of the log. There is a good chance that the new log data are more significant than the specified. To fix it, follow these steps:

First, launch Run by pressing Windows Key + R.
Type regedit and press Enter.
Go to the following locations one by one:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security

and

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security

Inside both these registry locations, you will find a Retention value.
Right-click on Retention > Modify.
Over here, set the value to 0 and click on OK.

Finally, reboot your PC and see if Event Viewer is logging new data.

Read: How to fix or repair corrupted or damaged Registry in Windows

4] Run SFC and DISM Scans

SFC and DISM can fix system file issues; we suggest running this if none of the above methods works. If the Even viewer or related files have issues, the tools can replace them with a fresh copy to help you resolve them.

5] System Restore

System Restore takes your PC to a working state where the event viewer works as expected. So if you have a restore point, and you are sure the Even Viewer was working on that date, then make sure to restore.

The above steps will help you to troubleshoot any issues with the Event Viewer and help you with a fix. If the solutions don’t work, consider updating or resetting your Windows.

How do I reset Event Viewer?

To clear logs in Event Viewer, press Win + R, type eventvwr.msc, and click OK. Select the log to clear in the left pane, then click Clear Log in the right Actions pane or right-click the log and choose Clear Log.

Read: Event Viewer logs are missing in Windows

How do I use Event Viewer after crash?

After a Windows crash, navigate to Windows Logs > System to find Error or Critical events indicating the crash. Click on an event for details like Event ID and Source, providing clues to the crash’s cause. Additionally, check for crash dump files in C:\Windows\Minidump, which can offer valuable insights but require technical expertise to interpret.