Odd problem with Event Viewer

[valter]

Few days ago while I was trying to open Application log in the Event Viewer on the Windows Server 2003 R2 Standard SP1, I've run into error message as follows:

MMC has detected an error in a snap-in. It is recommended that you shut down and restart MMC

The suggested solution, didn't help, the only available article about this issue is KB915797 and even though I did what they suggest as Continue running and always ignore errors with this snap-in and later installed suggested hotfix, nothing has changed. I still can not read Application log, while other logs work just fine. If I try to point blank and try to open any event in App log I get the well known error Event Viewer has perormed an illegal operation and needs to close ...

I've even reinstalled MMC 3, but that didn't help either.

Anyone else seen this before?

Edited October 16, 2006 by klasika

[cluberti]

I've seen this before when one (or more) of the event log files themselves (.evt files) becomes corrupt:

http://support.microsoft.com/kb/172156

[X-Centric]

I have this problem on two different machines with Enterprise R2. It only happens with the application log. If you delete the log as per microsoft and its recreated the error comes back. It appears to be a problem with MMC 3.0. If you ignore the error you cannot see the entries in the log but they "ARE" there. Try double-clicking in the results area you'll see what I'm talking about. Can anyone else confirm this? And has anyone found a solution?

[valter]

Well after almost 2 months emailing with Microsoft Support, we've pin point the problem, and it apears to be Serv-U FTP server. For some reason, when I try to opet any event in Application log, MMC calls Serv-U FTP Daemon as the source for the event viewer!

Anyway, MS Support asked me to make a dump file and upload it to them (170+ MB), 10 minutes later, they send me the "solution", to delete the following key HKLM\System\CurentControlSet\Services\Eventlog\Application\Serv-U Ftp Server ... as soon as I have removed the aforementioned key, Application log works just the way it should. I have to try and remove FTP server and install it back on to see if that would help at all ...

[X-Centric]

Wow! Say no more. Serv-U is installed on both the machines in question. The version installed is 6.3.0.1.

Edited December 13, 2006 by X-Centric

[valter]

Well there you go ... try removing the aforementioned registry key and see what happens with event log. As soon as Serv-U service is restarted, the registry key is regenerated, so it looks like the only solution is to remove Serv-U for good ...

[X-Centric]

Just tried your solution and it worked. I'm going to try downgrading version by version because I know this issue is only recent. If I'm not mistaken the previous version 6.3.0.0 didnt have this problem. I'll let you know. Serv-U should know about this.

Edited December 13, 2006 by X-Centric

[valter]

You bet they should, they should pay for the support case as well ...

btw mine is 6.3.0.1

[X-Centric]

Confirmed! Downgrade to 6.3.0.0 and the problem is gone! Thanks to your research we have a temporary solution. We will have to wait and see if serv-u will pick up on this bug in a future version. After all it was 6.3.0.1 that broke the application log. Serv-U has been notified.

Edited December 13, 2006 by X-Centric