Fix 0XC01A0028: Log Container Write Failed

You're seeing STATUS_LOG_CONTAINER_WRITE_FAILED (0XC01A0028) and your logs have stopped. That's annoying, but it's almost always fixable.

Let's get straight to it. The real fix is to grant the log service account write permissions on the container directory or volume. Here's how to do it.

Step 1: Identify the log service account

Open Services (services.msc) and find the service that's failing. Common ones: Windows Event Log, Windows Event Collector, or a third-party log agent like Fluent Bit or NXLog. Right-click, choose Properties, and go to the Log On tab. Note the account name — it's often NT SERVICE\EventLog, LocalSystem, or a domain service account.

If you're on Linux, the log container might be a Docker volume or a directory like /var/log/containers. The service account is usually root or a dedicated user like syslog or fluent.

Step 2: Check the container path and its permissions

On Windows, open File Explorer and navigate to the log container folder. For the Windows Event Log, it's C:\Windows\System32\winevt\Logs. For a custom container, check the service's config file. Right-click the folder, go to Properties > Security. You should see the service account listed with Write and Modify permissions. If not, add it.

icacls "C:\Windows\System32\winevt\Logs" /grant "NT SERVICE\EventLog:(OI)(CI)(M)"

On Linux, run:

ls -ld /var/log/containers

You should see something like drwxrwxr-x 2 root syslog 4096 .... If the service account doesn't have write access, fix it with:

sudo chown -R syslog:syslog /var/log/containers
sudo chmod -R 775 /var/log/containers

Step 3: Restart the log service

After applying permissions, restart the service. In Services, right-click and choose Restart. On Linux:

sudo systemctl restart rsyslog

Watch the event log or journal for new entries. You should see the service start without errors. If the error persists, move to Step 4.

Step 4: Check for disk space and container corruption

A full disk or a corrupted log container can also trigger 0XC01A0028. Check free space:

df -h

If the volume is full, clear old logs. On Windows, use Disk Cleanup or manually delete old .evtx files. If corruption is suspected, rebuild the container. For Windows Event Log, stop the service, rename the Logs folder to Logs.old, and restart — Windows will create a fresh folder. For Linux, archive and recreate the directory.

Step 5: Verify the fix

Generate a test log entry. On Windows, run:

eventcreate /T INFORMATION /ID 999 /L APPLICATION /D "Test log entry"

On Linux:

logger "Test log entry"

Check the log container for the new entry. If it appears, you're done.

Why this works

The log service runs under a specific account. If that account doesn't have write access to the container, the service can't write logs. Error 0XC01A0028 is Windows' way of saying "access denied" at the container level. Fixing permissions or clearing corruption removes the block.

Less common variations

Antivirus interference: Some AV tools lock log files. Add the container folder to exclusions.
Group Policy restrictions: Check gpedit.msc for log service policies that might restrict write access.
Container path changed: If you moved the container, update the service config to point to the new location.
Corrupted service profile: Recreate the service account's profile if it's a domain account.

Prevention

Set up monitoring for disk space on log volumes. Rotate logs regularly. Use a dedicated service account with just enough permissions — don't run as LocalSystem unless you have to. Test log writes after any permission change. Keep your log service updated to avoid known bugs.

That's it. Most of the time, Step 2 fixes it. If not, the variations above cover the rest.