Error Message

Event Viewer cannot open the event log or custom view. Verify that Event Log service is running, or query is too long. The parameter is incorrect. (87)

This issue occurs if the Registry key's File path value is not set automatically or the File path is empty after Enterprise Vault installation.

RegKey is being created; Windows Event Log service is not automatically creating the corresponding event log as from Windows server 2025, the Event having subkey as 'File' cannot be blank.

Run the following three commands one by one as Administrator in the Windows PowerShell:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Veritas Enterprise Vault" -Name "File" -Value "%SystemRoot%\System32\Winevt\Logs\Veritas Enterprise Vault.evtx" -Type ExpandString
 
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Veritas Enterprise Vault Converters" -Name "File" -Value "%SystemRoot%\System32\Winevt\Logs\Veritas Enterprise Vault Converters.evtx" -Type ExpandString
 
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Veritas Enterprise Vault CryptoModule" -Name "File" -Value "%SystemRoot%\System32\Winevt\Logs\Veritas Enterprise Vault CryptoModule.evtx" -Type ExpandString

Restart the Windows Event Log service.

• For Veritas Enterprise Vault, the Event Viewer cannot open the event log or custom view for Windows server 2025
• 'Veritas Enterprise Vault' event log is not opening for VAC-only installation for Windows 11 24H2