Home » Windows » 6 Ways to Fix Event Log Service Is Unavailable on Windows 10

6 Ways to Fix Event Log Service Is Unavailable on Windows 10

by Pratik

The ‘Event Log Service is unavailable’ is a well-known Windows error. I have faced this issue on numerous occasions in my long Windows usage. Most of the time, the reason is either messed up file permissions or the inability of the Windows Log Event service to restart. Here’s how you can quickly fix all of that.

Event Log Service is Unavailable

What is Event Log Service?

Event Log Service, as the name suggests, is the Windows inbuilt service program. The location of the Event Log program is C:\Windows\System32\svchost.exe. Basically, it logs all the information as well as error messages in a text file. Most of the internal Windows system jobs depend on the Windows Event Log Service. A handful of Windows applications like Task Schedular, Calendar, or Mail won’t function properly without this service. Hence, it’s important to ensure that the Windows Event Log Service is up and running.

With that out of the way, before we get to the troubleshooting steps, I would recommend you first try a good old restart. If that doesn’t work, we can move ahead with the below methods.

1. Start Windows Log Service

Foremost, we can try and start the Windows Event Log service manually. To do that, head over to the Run menu by pressing Win+R, type services.msc and hit Enter.

services msc on run menu

On the Services menu, navigate to the Windows Event Log service.

windows event log on windows services menu

Right-click on the Windows Event Log service and click on Start. In case the service is already running, click on Restart. You might also be prompted for the administrator password, enter it accordingly.

start windows event log service

Once the Windows Event Log service starts successfully, the error should be solved. Also, make sure that the Startup Type for the service is set to Automatic. If it’s Manual or blank, you can change it from the Properties.

2. Regedit value

If you are not able to start the Windows Event Log service, there might be issues with the ownership of the Windows Event Log service. To fix that, we need to first check and ensure that the owner of the Windows Log program is correct. This has to be done through the Registry editor.

To open the Registry Editor, hit Win+R to access the Run menu, type regedit, and hit Enter.

regedit on run menu

On the Registry Editor menu, copy-paste the following URL.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog
url on registry editor

Under the Event Log folder, you will find a key called “Object Name“. Make sure the value of the key is NL AUTHORITY\LocalService. If the value is empty or different, double-click on it to change the value.

event log folder in registry editor

On the pop-up, change the Value data to NL Authority\LocalService. Once done, click on the OK button.

object name value in registry editor

Now, you can try restarting the Windows Event Log service from the services menu. In case you still face issues, move to the next step.

3. Check Permissions

Another reason for the failure of the Windows Event Log service to start is incorrect permissions to the Log directory. In order to fix that, head over to Windows Explorer and copy-paste the following URL.

 C:\Windows\System32\winevt\Logs

Right-click on the Logs folder and click on Properties.

logs folder in Windows Explorer

On the Properties menu, navigate to the Security tab.

security tab of windows logs folder

Under the Security tab, click on SYSTEM profile and see that it has all the permissions under the Permissions tab. After SYSTEM profile, check for Administrators and EventLog profile.

permissions for system profile in security tab

If full permissions aren’t provided to the account, click on the Edit button, and provide the necessary permissions. Are you still facing the ‘Event Log Service is Unavailable’ error on your Windows computer?

4. Check Log Retention

If the above methods didn’t fix the issue, there might be problems with the actual log files being full. We can check the status of the log files through Window’s own Event Viewer application.

Head over to the Start menu and type Event Viewer. Once the results pop up, click on Run as Administrator.

event viewer in start menu

On the Event Viewer window, click on Windows Logs. Under Windows, you’ll find logs for Application, Security, Setup, System, and Forwarded events. We need to check each event individually. But first, let’s check Application Logs.

On the right-hand side, you will an option called Properties. Click on it to open Application Logs properties.

windows logs in event viewer

On the Log Properties popup, ensure that the “Overwrite events as needed” button is checked. This ensures that when the log files are filled, it’ll overwrite them. Next, click on the OK button.

overwrite events in windows logs

Similar to the Application Properties, we need to check the other 4 logs for the same option. Once done, restart your Windows system. Next, try restarting the Windows Event Log service. It should start running normally.

5. Clean Up Old Logs

Even after providing permissions and authority, if the Windows Log Event service fails to start, we can do a general cleanup of the RtBackup folder. The RtBackup folder contains the real-time event logs of applications, kernels, and system issues. At times, older logs can cause the Windows Event Log service from functioning.

However, cleaning up this folder isn’t easy. You would have to boot into safe mode and change a couple of permissions as well. The easiest way to boot into safe mode is via the Windows Configuration. Press Win+R to trigger the Run menu, type msconfig, and hit Enter.

msconfig in run menu

Click on Boot tab and check the “Safe Boot” option. Next, click on the OK button.

safe boot option

Once done, you can now restart your system.

restart windows system

Now, Windows should boot up in Safe Mode.

safe mode windows 10

In Safe mode, head over to the following file location.

C:\Windows\System32\LogFiles\WMI\RtBackup

By default, the RtBackup folder is owned by the System and you cannot open or delete the folder. Hence, right-click on it and click on Properties.

properties option for rtbackup

On the Properties menu, head over to the Security tab and click on the Advanced button.

advanced security properties

Once the Advanced security tab opens, click on the Change link beside the Owner section.

change the owner of rtbackup

On the popup, type your username in the “Enter the object name to select” textbox and click on the Check Names button. Once it detects your username, click on the OK button.

In case you don’t know your user name, head over to the command prompt, and just type whoami.

set current user as owner

On the Advanced Security menu, click the checkbox named “Replace owner on subcontainers and objects“. Next, click on the OK button to save the changes.

replace owner on subcontainer and objects

Once done, you can now right-click on the RtBackup folder and delete it or even rename it.

delete rtbackup folder

Next, restart your Windows machine and the issue should be resolved.

6. Backup & Reinstall Windows

If none of the above methods have worked, unfortunately, you would have to reinstall Windows. Foremost, backup your machine with a third-party free backup app before you proceed with the reinstallation.

Closing Words: Event Log Service Is Unavailable

These were the 5 nifty ways to fix Windows Event Log Service is Unavailable error. Once it’s fixed, you should be able to use your Windows machine normally.

Also Read: 6 Ways to Fix Delayed Auto Start Flag Error 87 in Windows 10

You may also like