Windows Event ID 4108 – Microsoft-Windows-Eventlog: Event Log Service Encountered an Error

Start by verifying available disk space and examining event log file integrity:

1. Open File Explorer and navigate to C:\Windows\System32\winevt\Logs
2. Check available disk space on the C: drive. Event logs require at least 100MB free space for normal operations
3. Run PowerShell as Administrator and execute:

   Get-WinEvent -ListLog * | Where-Object {$_.RecordCount -eq $null -or $_.LogFilePath -eq $null} | Select-Object LogName, LogFilePath, RecordCount

4. Check for corrupted log files:

   Get-ChildItem "C:\Windows\System32\winevt\Logs\*.evtx" | ForEach-Object { try { Get-WinEvent -Path $_.FullName -MaxEvents 1 -ErrorAction Stop; Write-Host "$($_.Name): OK" -ForegroundColor Green } catch { Write-Host "$($_.Name): CORRUPTED" -ForegroundColor Red } }

5. If disk space is low, clean up old log files or increase log size limits using Event Viewer

Restart the Event Log service and clear any corrupted log files:

1. Open Services.msc as Administrator
2. Locate Windows Event Log service and note any dependent services
3. Stop the Event Log service:

   Stop-Service -Name "EventLog" -Force

4. Wait 30 seconds, then restart the service:

   Start-Service -Name "EventLog"

5. If corruption is detected, clear specific corrupted logs:

   wevtutil cl System
   wevtutil cl Application

6. Verify service status:

   Get-Service -Name "EventLog" | Select-Object Name, Status, StartType

7. Check if Event ID 4108 continues to appear in the System log

Investigate and repair Event Log service registry settings:

1. Open Registry Editor (regedit.exe) as Administrator
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\EventLog
3. Verify the following registry values exist and are correct:
   • ImagePath: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p
   • Start: 2 (Automatic)
4. Check individual log configurations at HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System
5. Export current registry settings for backup:

   reg export "HKLM\SYSTEM\CurrentControlSet\Services\EventLog" "C:\Temp\EventLog_Registry_Backup.reg"

6. If registry corruption is suspected, restore from a known good backup or reset to defaults
7. Restart the system to apply registry changes

Use built-in Windows tools to repair system files and event log infrastructure:

1. Run System File Checker to repair corrupted system files:

   sfc /scannow

2. Check the SFC log for event log related repairs:

   findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log | findstr /i "event"

3. Run DISM to repair Windows image:

   DISM /Online /Cleanup-Image /RestoreHealth

4. Rebuild event log configuration using PowerShell:

   Get-WinEvent -ListLog * | ForEach-Object { if($_.IsEnabled) { wevtutil set-log $_.LogName /enabled:false; wevtutil set-log $_.LogName /enabled:true } }

5. Check Windows Event Log service dependencies:

   sc qc EventLog

6. Verify all dependent services are running properly

Use advanced diagnostic tools to identify the root cause of Event Log service errors:

1. Download and run Process Monitor from Microsoft Sysinternals
2. Set filters to monitor EventLog service activity:
   • Process Name: svchost.exe
   • Path contains: winevt
3. Enable Event Log service tracing:

   wevtutil set-log Microsoft-Windows-Eventlog/Debug /enabled:true

4. Monitor real-time event log operations:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Eventlog/Debug'} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

5. Check for file system errors on the system drive:

   chkdsk C: /f /r

6. Analyze Process Monitor logs for file access failures, permission issues, or disk errors
7. Review Windows Reliability Monitor for correlating system events
8. Disable Event Log debug tracing after troubleshooting:

   wevtutil set-log Microsoft-Windows-Eventlog/Debug /enabled:false