diff --git a/reactos/base/services/eventlog/eventlog.c b/reactos/base/services/eventlog/eventlog.c
index 0f3927a63e8..288dcf65286 100644
--- a/reactos/base/services/eventlog/eventlog.c
+++ b/reactos/base/services/eventlog/eventlog.c
@@ -327,7 +327,7 @@ PLOGFILE LoadLogFile(HKEY hKey, WCHAR * LogName)
 
     DPRINT("%S -> %S\n", Buf, Expanded);
 
-    Status = LogfCreate(&pLogf, LogName, &FileName);
+    Status = LogfCreate(&pLogf, LogName, &FileName, TRUE, FALSE);
     if (!NT_SUCCESS(Status))
     {
         DPRINT1("Failed to create %S! (Status %08lx)\n", Expanded, Status);
diff --git a/reactos/base/services/eventlog/eventlog.h b/reactos/base/services/eventlog/eventlog.h
index 9966b0aa5a9..613998f933b 100644
--- a/reactos/base/services/eventlog/eventlog.h
+++ b/reactos/base/services/eventlog/eventlog.h
@@ -92,6 +92,7 @@ typedef struct _LOGFILE
     PEVENT_OFFSET_INFO OffsetInfo;
     ULONG OffsetInfoSize;
     ULONG OffsetInfoNext;
+    BOOL Permanent;
     LIST_ENTRY ListEntry;
 } LOGFILE, *PLOGFILE;
 
@@ -157,9 +158,13 @@ LogfBackupFile(PLOGFILE LogFile,
 NTSTATUS
 LogfCreate(PLOGFILE *Logfile,
            WCHAR * LogName,
-           PUNICODE_STRING FileName);
+           PUNICODE_STRING FileName,
+           BOOL Permanent,
+           BOOL Backup);
 
-VOID LogfClose(PLOGFILE LogFile);
+VOID
+LogfClose(PLOGFILE LogFile,
+          BOOL ForceClose);
 
 VOID LogfCloseAll(VOID);
 
diff --git a/reactos/base/services/eventlog/file.c b/reactos/base/services/eventlog/file.c
index f4933b92fd1..30d935e05de 100644
--- a/reactos/base/services/eventlog/file.c
+++ b/reactos/base/services/eventlog/file.c
@@ -292,7 +292,9 @@ BOOL LogfInitializeExisting(PLOGFILE LogFile)
 NTSTATUS
 LogfCreate(PLOGFILE *LogFile,
            WCHAR * LogName,
-           PUNICODE_STRING FileName)
+           PUNICODE_STRING FileName,
+           BOOL Permanent,
+           BOOL Backup)
 {
     OBJECT_ATTRIBUTES ObjectAttributes;
     IO_STATUS_BLOCK IoStatusBlock;
@@ -314,13 +316,13 @@ LogfCreate(PLOGFILE *LogFile,
                                NULL);
 
     Status = NtCreateFile(&pLogFile->hFile,
-                          GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,
+                          Backup ? (GENERIC_READ | SYNCHRONIZE) : (GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE),
                           &ObjectAttributes,
                           &IoStatusBlock,
                           NULL,
                           FILE_ATTRIBUTE_NORMAL,
                           FILE_SHARE_READ,
-                          FILE_OPEN_IF,
+                          Backup ? FILE_OPEN : FILE_OPEN_IF,
                           FILE_SYNCHRONOUS_IO_NONALERT,
                           NULL,
                           0);
@@ -371,6 +373,8 @@ LogfCreate(PLOGFILE *LogFile,
 
     pLogFile->OffsetInfoSize = 64;
 
+    pLogFile->Permanent = Permanent;
+
     if (bCreateNew)
         bResult = LogfInitializeNew(pLogFile);
     else
@@ -411,11 +415,17 @@ LogfCreate(PLOGFILE *LogFile,
     return Status;
 }
 
-VOID LogfClose(PLOGFILE LogFile)
+VOID
+LogfClose(PLOGFILE LogFile,
+          BOOL ForceClose)
 {
     if (LogFile == NULL)
         return;
 
+    if ((ForceClose == FALSE) &&
+        (LogFile->Permanent == TRUE))
+        return;
+
     RtlAcquireResourceExclusive(&LogFile->Lock, TRUE);
 
     FlushFileBuffers(LogFile->hFile);
@@ -436,7 +446,7 @@ VOID LogfCloseAll(VOID)
 {
     while (!IsListEmpty(&LogFileListHead))
     {
-        LogfClose(LogfListHead());
+        LogfClose(LogfListHead(), TRUE);
     }
 
     DeleteCriticalSection(&LogFileListCs);
diff --git a/reactos/base/services/eventlog/rpc.c b/reactos/base/services/eventlog/rpc.c
index 4185463f61e..73088d95e20 100644
--- a/reactos/base/services/eventlog/rpc.c
+++ b/reactos/base/services/eventlog/rpc.c
@@ -158,7 +158,9 @@ ElfCreateBackupLogHandle(PLOGHANDLE *LogHandle,
     /* Create the log file */
     Status = LogfCreate(&lpLogHandle->LogFile,
                         NULL,
-                        FileName);
+                        FileName,
+                        FALSE,
+                        TRUE);
     if (!NT_SUCCESS(Status))
     {
         DPRINT1("Failed to create the log file! (Status 0x%08lx)\n", Status);
@@ -210,9 +212,7 @@ ElfDeleteEventLogHandle(IELF_HANDLE EventLogHandle)
     if (!ElfGetLogHandleEntryByHandle(lpLogHandle))
         return STATUS_INVALID_HANDLE;
 
-    /* Close the log file if it is a backup file */
-    if (lpLogHandle->Flags & LOG_HANDLE_BACKUP_FILE)
-        LogfClose(lpLogHandle->LogFile);
+    LogfClose(lpLogHandle->LogFile, FALSE);
 
     RemoveEntryList(&lpLogHandle->LogHandleListEntry);
     HeapFree(GetProcessHeap(),0,lpLogHandle);