JSI Tip 2250. Opening a 'saved' event log generates 'The event log file is corrupt'?

We first discussed local event log corruption in tip 1487.

If you receive the subject message when opening an event log that was saved using the Save As command, try opening it with the Open command on the Log menu.

The problem is caused by the event logging service having an open handle to the .evt file.

If you are going to copy an event log file, you must first set the Event Log service to Disabled. After restarting your computer, copy the .evt file(s) to another folder. Then set the Event Log service to Automatic and restart your computer.

Another option is to use the Dumpel.exe program while the Event Log service is running.