Fix ERROR_LOG_METADATA_CORRUPT (0X000019D4) in Windows

You're stuck with a dead Event Viewer and a 0X000019D4 error

Yeah, I've been there. The Event Log service won't start, and the system logs are gone. The culprit here is almost always a corrupted .evtx file — usually from an abrupt shutdown, failed disk write, or a patching nightmare. Here's how I fix it in under ten minutes.

Step 1: Stop the Windows Event Log service

Open an admin PowerShell or Command Prompt. Run:

net stop EventLog /y

Don't bother trying to stop it via services.msc — it'll hang. Use the command line. The /y flag forces dependent services to stop too.

Step 2: Find and rename the corrupted .evtx files

The corrupted metadata file is almost always one of these:

C:\Windows\System32\winevt\Logs\System.evtx
C:\Windows\System32\winevt\Logs\Application.evtx
C:\Windows\System32\winevt\Logs\Security.evtx

Start with System.evtx — that's the one that breaks things the most. Rename it, don't delete it yet:

ren C:\Windows\System32\winevt\Logs\System.evtx System.old

If you get a file-in-use error, make sure the service is truly stopped. Check with sc query EventLog. If it's still running, use taskkill /f /im svchost.exe — but be careful, that kills all service host processes. Safer to reboot into Safe Mode if the rename keeps failing.

Step 3: Restart the service

Now start the Event Log service back up:

net start EventLog

Windows will create a fresh System.evtx automatically. Open Event Viewer — it should load with no errors. The old logs are gone, but you've got a working system. The Security log might still be broken if it was corrupted too — repeat the rename for Security.evtx if needed.

Why this works

Event Log metadata corruption happens when the internal index or header of the .evtx file gets scrambled. The service tries to read the header on startup and chokes. By renaming the file, you force Windows to generate a new one with clean metadata. The old file is just a renamed text file at this point — you can delete it after a week if nothing else breaks.

This is different from simple log corruption where the service starts but individual events show errors. That's a different beast — you'd need wevtutil to repair or export logs.

Less common variations of the same issue

Sometimes it's not the big three logs. I've seen this with custom logs like Microsoft-Windows-TaskScheduler/Operational or even DNS Server logs. The fix is the same — locate the log file in winevt\Logs, check its size (anything over 500MB is suspicious), and rename it.

Another variation: the error appears only during boot, then the service starts normally after a few seconds. That's often a disk I/O bottleneck. Run chkdsk /f on the system drive and check event log for disk warnings.

If you're on Windows Server 2012 R2 or older, I've also seen this triggered by antivirus locking the log files. Exclude C:\Windows\System32\winevt\Logs\ from real-time scanning.

Prevention

Three things that stop this from coming back:

Set a log size limit. Right-click on each log in Event Viewer, go to Properties, set a maximum size (I use 20MB for System, 50MB for Application, 100MB for Security). Check "Overwrite events as needed." Oversized logs are fragile.
Use a UPS. Corrupt metadata is almost always from a sudden power loss. A cheap UPS pays for itself in a month.
Don't disable the event log service via group policy. I've seen admins do this to reduce disk writes, and it causes corruption when the service is eventually re-enabled.

That's it. You'll fix it in five minutes, and next time you'll know exactly what to do.