Fix Event Viewer Won’t Archive Logs in Windows 10

If Event Viewer in Windows 10 stops archiving logs automatically, the cause is usually a misconfigured log size limit, a full disk, or corrupted event log files. The fix is to reset the log properties, clear the existing logs, and verify the Windows Event Log service is running with the correct startup type.

How Event Viewer Log Archiving Works

Windows Event Viewer records system, security, and application events into log files stored in the C:\Windows\System32\winevt\Logs folder. Each log (e.g., Application, System, Security) has a maximum size, typically 20 MB by default, and a retention policy. When the log reaches its maximum size, Windows either overwrites the oldest events or archives the log to a new file, depending on the configured action. Archiving means the current log is saved with a timestamped name (like Application-2025-01-15.evtx) and a fresh log is started.

The archiving behavior is controlled by the Log Properties dialog in Event Viewer. You can access it by right-clicking a log name under Windows Logs and selecting Properties. The key settings are:

Maximum log size (KB) – the size at which the log triggers a retention action.
When maximum event log size is reached – options are Overwrite events as needed, Archive the log when full, do not overwrite events, or Do not overwrite events (clear logs manually).

If you select Archive the log when full, Windows will create an archive file in the same folder, but only if the folder is writable and has enough free space.

Why Archiving Stops

Several common issues prevent archiving from working:

Disk space exhaustion – The winevt\Logs folder may be on a full drive. Windows will not archive if it cannot write the new file.
Corrupted log file – A log that is corrupted (often due to abrupt shutdowns or disk errors) may stop responding to archive requests.
Service misconfiguration – The Windows Event Log service must be running and set to Automatic startup. If it is disabled or stopped, archiving cannot occur.
Incorrect permissions – The winevt\Logs folder must allow the SYSTEM account full control. If permissions are altered, archiving fails silently.
Group Policy override – In domain environments, a Group Policy may force a specific retention method that disables archiving.

Step-by-Step Fix

Follow these steps in order. Most users resolve the issue with steps 1–3.

Check the Windows Event Log service – Press Win + R, type services.msc, and press Enter. Find Windows Event Log. Ensure its Status is Running and Startup type is Automatic. If not, right-click and select Properties, set startup to Automatic, click Start, then OK.
Reset log properties – Open Event Viewer (press Win + X and select Event Viewer). Expand Windows Logs, right-click the log that isn’t archiving (e.g., Application), and choose Properties. Set a reasonable maximum size (e.g., 20480 KB for 20 MB). Under When maximum event log size is reached, select Archive the log when full, do not overwrite events. Click Apply and OK.
Clear the existing log – Right-click the same log, select Clear Log…. In the dialog, choose Save and Clear to keep a copy, or Clear to discard. This forces Windows to create a fresh log file and re-evaluate the retention policy.
Check disk space – Open This PC and verify the drive containing C:\Windows\System32\winevt\Logs has at least a few hundred MB free. If it is low, delete temporary files or move the log folder to another drive (advanced).
Repair corrupted logs – If clearing does not help, stop the Windows Event Log service, rename the problematic .evtx file (e.g., Application.evtx to Application.old), then restart the service. Windows will create a new log file. This is safe because the old file is preserved.
Check Group Policy – If you are on a domain, run gpedit.msc (Pro/Enterprise) and navigate to Computer Configuration → Administrative Templates → Windows Components → Event Log Service. Ensure the settings for Application, Security, and System do not force Overwrite or Do not overwrite that conflicts with archiving. If a policy is enforced, you may need to ask your administrator to adjust it.

What to Do If the Fix Doesn’t Work

If archiving still fails after the above, try these advanced steps:

Run the System File Checker – Open Command Prompt as administrator and run sfc /scannow. This repairs corrupted Windows system files that may affect the event log service.
Use DISM – If SFC finds issues, run DISM /Online /Cleanup-Image /RestoreHealth to repair the system image.
Check for third-party interference – Some security software or disk cleanup tools may lock or delete event log files. Temporarily disable such tools to test.
Create a custom archive location – In the log properties, you can specify a folder for archived logs under Archive location. Ensure that folder exists and is writable.

Common Misconceptions

A frequent belief is that setting the log size to a huge value (like 1 GB) will prevent archiving issues. In reality, a very large log file can become slow to read and more prone to corruption. Archiving is the safer approach because it keeps the active log small and preserves history. Another misconception is that clearing a log deletes all history permanently – if you choose Save and Clear, you keep the archived file. Also, some users think that archiving only happens when the system shuts down; actually, it triggers when the size limit is reached, regardless of uptime.

Preventing Future Archiving Problems

To avoid recurrence, adopt these habits:

Set a reasonable maximum log size (e.g., 20–50 MB) and choose Archive the log when full.
Monitor disk space on the system drive, especially if you have many logs.
Periodically check the winevt\Logs folder for archive files and move or delete old ones to free space.
Ensure the Windows Event Log service is set to Automatic and not disabled by any optimization tool.
If you are an advanced user, consider using wevtutil command-line tool to configure logs: wevtutil sl Application /ms:20480 /rt:true sets the max size and enables retention (archiving).

Frequently Asked Questions

Why does Event Viewer say “The log file is corrupted”? This usually happens after an unclean shutdown or disk error. The log file may be unreadable. The safest fix is to stop the Event Log service, rename the .evtx file, and restart the service. Windows will create a new log file, and you can attempt to open the old one with a third-party tool if needed.

Can I change where archived logs are saved? Yes. In the log properties, under Archive location, you can specify a folder. Make sure the folder exists and the SYSTEM account has write permissions. If the folder is on a different drive, ensure that drive has sufficient space.

Will archiving slow down my computer? No. Archiving happens in the background and is a lightweight operation. However, if you archive very frequently (e.g., set a tiny max size), it could cause constant disk writes. A 20 MB default is fine for most systems.

What is the difference between “Overwrite events” and “Archive the log”? Overwrite means the oldest events are deleted when the log is full, so you lose history. Archive means the current log is saved as a file and a new log starts, preserving all events. Archive is better for compliance or troubleshooting.

Do I need to restart the computer after changing log settings? No. Changes take effect immediately, but you may need to clear the log for the new retention policy to apply. A restart is not required unless the service itself is stuck.

Why is the Security log not archiving even after following these steps? The Security log is often controlled by Group Policy or audit policies. If you are not an administrator, you may not have permission to change its properties. Check with your IT department. Also, some security software may lock the Security log to prevent tampering.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →