[1.1.15b] not starting when EventLog not working

#1

Looks the glasswire Service has depencies with the eventlog (which currently not workling for me, Service is running)

13:32:10.10 [ERROR]  glasswire::service::manager::impl::evt_log_mng_t::startup: EvtSubscribe() returns error 50
13:32:10.11 [ERROR]  Managers initialization failed
13:32:10.12 [ERROR]  Service startup failed
#2

We’re changing this with our next release that should be out in a week or so.

#3

Ways to fix-

  1. Start Windows Log Service
    Foremost, we can try and start the Windows Event Log service manually. To do that, head over to the Run menu by pressing Win+R, type services.msc and hit Enter.

services msc on run menu
On the Services menu, navigate to the Windows Event Log service.

windows event log on windows services menu
Right-click on the Windows Event Log service and click on Start. In case the service is already running, click on Restart. You might also be prompted for the administrator password, enter it accordingly.

start windows event log service
Once the Windows Event Log service starts successfully, the error should be solved. Also, make sure that the Startup Type for the service is set to Automatic. If it’s Manual or blank, you can change it from the Properties.

  1. Regedit value
    If you are not able to start the Windows Event Log service, there might be issues with the ownership of the Windows Event Log service. To fix that, we need to first check and ensure that the owner of the Windows Log program is correct. This has to be done through the Registry editor.

To open the Registry Editor, hit Win+R to access the Run menu, type regedit, and hit Enter.

regedit on run menu
On the Registry Editor menu, copy-paste the following URL.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog
url on registry editor
Under the Event Log folder, you will find a key called “Object Name“. Make sure the value of the key is NL AUTHORITY\LocalService. If the value is empty or different, double-click on it to change the value.

event log folder in registry editor
On the pop-up, change the Value data to NL Authority\LocalService. Once done, click on the OK button.

object name value in registry editor
Now, you can try restarting the Windows Event Log service from the services menu. In case you still face issues, move to the next step.

  1. Check Permissions
    Another reason for the failure of the Windows Event Log service to start is incorrect permissions to the Log directory. In order to fix that, head over to Windows Explorer and copy-paste the following URL.

C:\Windows\System32\winevt\Logs
Right-click on the Logs folder and click on Properties.

logs folder in Windows Explorer
On the Properties menu, navigate to the Security tab.

security tab of windows logs folder
Under the Security tab, click on SYSTEM profile and see that it has all the permissions under the Permissions tab. After SYSTEM profile, check for Administrators and EventLog profile.

permissions for system profile in security tab
If full permissions aren’t provided to the account, click on the Edit button, and provide the necessary permissions. Are you still facing the ‘Event Log Service is Unavailable’ error on your Windows computer?

  1. Check Log Retention
    If the above methods didn’t fix the issue, there might be problems with the actual log files being full. We can check the status of the log files through Window’s own Event Viewer application.

Head over to the Start menu and type Event Viewer. Once the results pop up, click on Run as Administrator.

event viewer in start menu
On the Event Viewer window, click on Windows Logs. Under Windows, you’ll find logs for Application, Security, Setup, System, and Forwarded events. We need to check each event individually. But first, let’s check Application Logs.

On the right-hand side, you will an option called Properties. Click on it to open Application Logs properties.

windows logs in event viewer
On the Log Properties popup, ensure that the “Overwrite events as needed” button is checked. This ensures that when the log files are filled, it’ll overwrite them. Next, click on the OK button.

overwrite events in windows logs
Similar to the Application Properties, we need to check the other 4 logs for the same option. Once done, restart your Windows system. Next, try restarting the Windows Event Log service. It should start running normally.

Regards,
Rachel Gomez