Windows 2008 Eventlog service not starting

Question/Problem:

Today we had a very serious problem with the event viewer trying to access the event logging service on our windows 2008 server running exchange 2007.

The server remained on status 'starting' and all dependant services didn't start. Including the exchange information store. After killing the process and trying to start the service again, we had an "error 87: the parameter is incorrect". Service still didn't start!

This happened after a reboot, most likely due to updates...

The answer/solution:

I eventually fixed it by uninstalling the most recent updates and then replacing these DLL files with their originals from a backup:

%windir%/system32/wevtapi.dll
%windir%/system32/wevtfwd.dll
%windir%/system32/wevtsvc.dll

After a reboot all was good again.

If this doesn't work for you, also delete all the logs from this folder:

%windir%\winEvt\Logs

added by Jos on: 22-12-2008

keywords: windows 2008, eventlog, event log, error 87,