Error Message: Could Not Start the Event Log Service (279754)



The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional

This article was previously published under Q279754

SYMPTOMS

When you start the Event Viewer tool, you may receive the following error message:
Could not start the Event Log service on [computer name].
When you attempted to manually start the Event Log service, you may receive the following error message:
Error 0126: The specified module could not be found.

CAUSE

This behavior can occur if the Eventlog.dll file is missing from the %Systemroot%\System32 folder and/or the %Systemroot%\System32\Dllcache folder.

RESOLUTION

To resolve this behavior, use either of the following methods:

Method 1:

  1. Insert the appropriate Windows 2000 CD-ROM into the CD-ROM drive.
  2. When the Autorun Wizard is displayed, click Cancel.
  3. Click Start, and then click Run.
  4. In the Open box, type: cmd, and then press ENTER.
  5. At a command prompt, type: sfc /purgecache, and then press ENTER.

    IMPORTANT: This command runs the System File Checker (SFC) tool, which purges the Dllcache folder and scans all system-protected files. If a file is not found or it is corrupt, the file is replaced by SFC.

    NOTE: If you run SFC on a computer that has Service Pack 1 for Windows 2000 installed, SFU may consume CPU resources and it may take much time to complete its task. You must let SFC finish before you proceed onwards.
  6. After SFC has completed, at a command prompt, change folders to %Systemroot%\System32\Dllcache (that is, the C:\Winnt\System32\Dllcache folder).
  7. Copy the Eventlog.dll file from the Dllcache folder to the %Systemroot%\System32 folder (that is, copy the file in the C:\Winnt\System32\Dllcache\Eventlog.dll folder to the C:\Winnt\System32 folder).
  8. Click Start, point to Programs, click Administrative Tools, and then click Services.
  9. Locate and right-click Event Log service, and then click start. The service should start.
  10. Run the Event Viewer tool.

Method 2:

  1. Click Start, click Search, and then click For Files or Folders.
  2. In the Search for files or folders named: box, type: eventlog.dll, and then click Search Now.

    NOTE: There should be two instances of the file: one in the %Systemroot%\System32 folder and the other in the %Systemroot%\System32\Dllcache folder.

    The %Systemroot%\System32\Dllcache folder is a hidden folder under the System32 folder. On the View tab, click Folder Options, and then click to select the Show hidden files and folders check box.
  3. If the file is in the %Systemroot%\System32\Dllcache folder and not in the %Systemroot%\System32 folder, copy the file from the Dllcache folder to the System32 folder, and then attempt to restart the Event Log service.
  4. If the file is not in either location, restore the file from the CD-ROM. To properly restore the Eventlog.dll file:
    1. Insert your Windows 2000 CD-ROM in your CD-ROM drive.
    2. Click Start, click Run, in the Open box, type: cmd, and then press ENTER.
    3. At a command prompt, type the following command, where [CD-ROM drive] is the drive letter for the CD-ROM drive, [file_name] is the name of the .dll file, and [drive_letter] is the drive letter where the Temp folder is located (for example, type: "expand e:\i386\eventlog.dl_ c:\temp\eventlog.dll" [without the quotation marks]):

      expand [CD-ROM drive]:\i386\[file_name].dl_ [drive_letter]:\temp\[file_name].dll
    4. Copy the file from the Temporary folder into the %Systemroot%\System32\Dllcache folder and the %Systemroot%\System32 folder.
  5. After the files have been placed in the proper folder, attempt to start the Event Log service and access the Event Viewer.

Modification Type:MinorLast Reviewed:1/26/2006
Keywords:kberrmsg kbprb KB279754