Hi, I'm running a 2008 server and I'm having problems with my security log in the event viewer. I wanted to reset the event log service but I'm unable to find it in the list of service. Can anybody tell me how I can stop this service? Thanks in advance. Regards.

To stop the service proceed like that: 1- Click on Run > services.msc 2- Select Event Log 3- Double click on it select Disabled and then click on Apply This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Thank you Mr X but, my problem is that I don't see the service in the list of services...

Check for the existence of this key. If not found then export the key from some other somputer in .reg format and import it in your computer HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventloghttp://www.virmansec.com/blogs/skhairuddin

I would like to mention that the service name in services.msc may change using the used display language on your computer. Just search the services in services.msc and you will find it. Example: Using frensh as display language, the name of the service is "Journal d'évènements Windows". If you will proceed like mentioned Syed, I recommand to you to backup your system state before proceeding. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Yes, I have the key. The security log behaviour is very strage. It only reports the 521 event id each several minutes...

Yes it's correct, my display language is english but I don't see the "event log" in the list. As I told to Syed, in the security log only the 521 event id is being reported, that's why I wanted to reset this service..

Event 521 means simply that you cannot log to the security log. Have you checked that the log is not full? Do you allow the Security log to overwrite? Are you using any third party logging tools? You may have a damaged Security.evtx. If so, you can change the location and file nome easily by right clicking on the Security.evtx -> Properties -> Location.... +++ As far as restarting the Event log without restarting the computer I haven't seen it done.

Try rebooting the server, if resolved the issue for this user: http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/9a203c59-ae8b-4513-aefa-0f67c900d80e

Hi, In Windows Server 2008, the full name for Event Log is “Windows Event Log”. To troubleshoot the Event ID 521, you may stop the Windows Event Log service, try to rename the %SystemRoot%\System32\Winevt\Logs\Security.evtx to Security.old and restart it to check the result. Regards,Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thank you, I've rebooted the server and it workrs fine again..

I'm having the same problem and I'm using a third party logging tool, in this case dumpevt. Could be this the problem? What can I do? Thanks again for your help.