none
System Log User "N/A"

    Question

  • In Event Log, does anyone know why SQL service was restarted, but “USER” info says “N/A”?  See attached.  Do you know a way to find more detailed log related to this EventID 102?  Is there a .log file that might have more info?

    Your help is appreciated!

    Friday, December 20, 2013 7:08 PM

Answers

All replies

  • There is SQL Server Agent Log as well you can view it from the SQL Server Management Studio, or you can go to [Drive]\Program Files\Microsoft SQL Server\MSSQL[Version]\MSSQL\Log, then there is the SQLAGENT.OUT, SQLAGENT.1 ... The same information should be on one of that log. However, it also don't contain the user information.

    One place you might want to look is the System log on the Event Viewer. There should be a corresponding entry in the system log that would provide the user information.

    Friday, December 20, 2013 8:38 PM
  • That entry is for the SQL Server Agent.  What does the MSSQLSERVER entry say below it?

    The SQL Server error log will show you why it restarted.

    • Proposed as answer by Shanky_621 Saturday, December 21, 2013 7:30 AM
    Friday, December 20, 2013 8:52 PM
  • Here’s the SQL log (see attached).  Do you know why Service Control Manager needs to shutdown SQL?  Trying to get to bottom of the restart.

    Friday, December 20, 2013 10:45 PM
  • My interpretation is that someone (= a human being) actively stopped SQL Server.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se
    • Proposed as answer by Shanky_621 Saturday, December 21, 2013 7:29 AM
    Friday, December 20, 2013 10:59 PM
  • Then the question is, who?  Application Event Log indicated User "N/A", why?  Any other ways to investigate which human being?

    Friday, December 20, 2013 11:01 PM
  • Have you checked the System Event Log? The user name normally would be logged there.

    Friday, December 20, 2013 11:08 PM
  • Same bug "N/A" under User.  See attached.  Any other idea?  Would Service Control Manager automatically shutdown SQL?

    Friday, December 20, 2013 11:18 PM
  • SQL Agent is stopped along with SQL Server?
    Could you please check the similar entry for SQL Server (MSSQLSERVER) and see if you have user name there?

    Balmukund Lakhani | Please mark solved if I've answered your question, vote for it as helpful to help other users find a solution quicker
    --------------------------------------------------------------------------------
    This posting is provided "AS IS" with no warranties, and confers no rights.
    --------------------------------------------------------------------------------
    My Blog | Team Blog | @Twitter
    Author: SQL Server 2012 AlwaysOn - Paperback, Kindle

    • Proposed as answer by Shanky_621 Saturday, December 21, 2013 7:30 AM
    Saturday, December 21, 2013 1:34 AM
    Moderator
  • By any chance is there earlier entry before that one that have SQL Agent information? Normally in our environment, we got similar entry "The SQL Server Agent (MSSQLSERVER) service entered the stopped state". That has user N/A.

    But then before that entry, we normally get another entry on the System event log "The SQL Server Agent (MSSQLSERVER) service was successfully sent a stop control" and that entry has the windows user name.

    From the SQL Server error log screen shot, it does look like your SQL Server was restarted, not just the SQL Server agent.

    Saturday, December 21, 2013 1:53 AM
  • For the record, this how it looks on my machine after that I stopped SQL Server through the SQL Server Configuration Manager:

    That is user is N/A. I'm not a Windows guy, so I don't know if it is expected to see the user who pressed the button here, but it could be that it is simply not recorded.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

    Saturday, December 21, 2013 10:21 AM
  • ...

    That is user is N/A. I'm not a Windows guy, so I don't know if it is expected to see the user who pressed the button here, but it could be that it is simply not recorded.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

    I can confirm this.

    This is an issue for a long time now. I think it changed back in Windows 2008. Before that, the Usernames were actually captured for more events.

    I can't give you a good reason for it though either.


    Andreas Wolter | Microsoft Certified Master SQL Server

    Blog: www.insidesql.org/blogs/andreaswolter
    Web: www.andreas-wolter.com | www.SarpedonQualityLab.com

    Saturday, December 21, 2013 2:34 PM
  • I found out more on this, in Windows 2003, when I stopped SQL Server Agent, I would get the same system event log as the one posted (Event ID 7036). But then, before that I also got Event ID 7035, which logged the information on who stopped the service:

    Unfortunately it looks like, in Windows 2008, event id 7035 is no longer being logged into Windows 2008. For Windows 2008 and later, there is a way to make it logged the user, but it needs to be configured:

    http://blogs.technet.com/b/askds/archive/2011/05/06/friday-mail-sack-who-am-i-kidding-more-like-monthly-edition.aspx#svcaudit

    Saturday, December 21, 2013 2:39 PM
  • Yes, that's precisely what I am seeing for both SQL Agent and SQL Server restart.  "N/A" are showing under User.  I'm on Win Server 2008.  I don't think configuraion setup above is very intuitive.  Is there a way track Event ID to a user?  See screenshot below:

    Monday, December 23, 2013 11:19 PM
  • unfortunately EventIDs do not correlate to Users but rather to Events

    Event ID 7036 i.e. correlates to "Basic Service Operations": http://technet.microsoft.com/en-us/library/cc756308%28v=ws.10%29.aspx

    This is a very Windows specific topic and even version specific. You can find more information on this thread: http://social.technet.microsoft.com/Forums/windowsserver/en-US/10906293-5548-40f2-8f57-9a47f2c1245c/list-of-error-event-id-in-windows-server-2008-r2?forum=winserverDS


    Andreas Wolter | Microsoft Certified Master SQL Server

    Blog: www.insidesql.org/blogs/andreaswolter
    Web: www.andreas-wolter.com | www.SarpedonQualityLab.com

    Monday, December 23, 2013 11:37 PM