Microsoft KB Archive/279754

= Error Message: Could Not Start the Event Log Service =

Article ID: 279754

Article Last Modified on 3/1/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q279754



SYMPTOMS
When you start the Event Viewer tool, you may receive the following error message:

Could not start the Event Log service on [ ].

When you attempted to manually start the Event Log service, you may receive the following error message:

Error 0126: The specified module could not be found.



CAUSE
This behavior can occur if the Eventlog.dll file is missing from the %Systemroot%\System32 folder and/or the %Systemroot%\System32\Dllcache folder.



RESOLUTION
To resolve this behavior, use either of the following methods:

Method 1:

 * 1) Insert the appropriate Windows 2000 CD-ROM into the CD-ROM drive.
 * 2) When the Autorun Wizard is displayed, click Cancel.
 * 3) Click Start, and then click Run.
 * 4) In the Open box, type: cmd, and then press ENTER.
 * 5) At a command prompt, type: sfc /purgecache, and then press ENTER.

IMPORTANT: This command runs the System File Checker (SFC) tool, which purges the Dllcache folder and scans all system-protected files. If a file is not found or it is corrupt, the file is replaced by SFC.

NOTE: If you run SFC on a computer that has Service Pack 1 for Windows 2000 installed, SFU may consume CPU resources and it may take much time to complete its task. You must let SFC finish before you proceed onwards.
 * 1) After SFC has completed, at a command prompt, change folders to %Systemroot%\System32\Dllcache (that is, the C:\Winnt\System32\Dllcache folder).
 * 2) Copy the Eventlog.dll file from the Dllcache folder to the %Systemroot%\System32 folder (that is, copy the file in the C:\Winnt\System32\Dllcache\Eventlog.dll folder to the C:\Winnt\System32 folder).
 * 3) Click Start, point to Programs, click Administrative Tools, and then click Services.
 * 4) Locate and right-click Event Log service, and then click start. The service should start.
 * 5) Run the Event Viewer tool.

Method 2:

 * 1) Click Start, click Search, and then click For Files or Folders.
 * 2) In the Search for files or folders named: box, type: eventlog.dll, and then click Search Now.

NOTE: There should be two instances of the file: one in the %Systemroot%\System32 folder and the other in the %Systemroot%\System32\Dllcache folder.

The %Systemroot%\System32\Dllcache folder is a hidden folder under the System32 folder. On the View tab, click Folder Options, and then click to select the Show hidden files and folders check box.
 * 1) If the file is in the %Systemroot%\System32\Dllcache folder and not in the %Systemroot%\System32 folder, copy the file from the Dllcache folder to the System32 folder, and then attempt to restart the Event Log service.
 * 2) If the file is not in either location, restore the file from the CD-ROM. To properly restore the Eventlog.dll file:


 * 1) Insert your Windows 2000 CD-ROM in your CD-ROM drive.
 * 2) Click Start, click Run, in the Open box, type: cmd, and then press ENTER.
 * 3) At a command prompt, type the following command, where [CD-ROM drive] is the drive letter for the CD-ROM drive, [file_name] is the name of the .dll file, and [drive_letter] is the drive letter where the Temp folder is located (for example, type: &quot;expand e:\i386\eventlog.dl_ c:\temp\eventlog.dll&quot; [without the quotation marks]):

expand [CD-ROM drive]:\i386\[file_name].dl_ [drive_letter]:\temp\[file_name].dll
 * 1) Copy the file from the Temporary folder into the %Systemroot%\System32\Dllcache folder and the %Systemroot%\System32 folder.
 * 2) After the files have been placed in the proper folder, attempt to start the Event Log service and access the Event Viewer.

Additional query words: eventlog.dll Event Log Service Viewer Error 0126

Keywords: kberrmsg kbprb KB279754

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.