none
ESENT Event ID 326 & 327 RRS feed

  • Question

  • My Application event viewer is logging these 2 events every second. Is anyone able to inform me on to why both are being logged that many times and if there is concern for worry.  Only thing installed other than Windows Server 2012 is SQL Server 2012.  I never noticed the log entries, seemed to have started sometime last week.  Only thing I have done since is scheduled Windows Backup. Any help would be greatly appreciated. -Chuck

    Event 326 -  svchost (2724) The database engine attached a database (2, c:\windows\system32\LogFiles\Sum\SystemIdentity.mdb).(Time = 0seconds)

    Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.047, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000. 
    Saved Cache: 1

    Event 327 - svchost (2724) The database engine detached a database (2, c:\windows\system32\LogFiles\Sum\SystemIdentity.mdb).(Time = 0seconds)

    Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.016, [7] 0.000, [8] 0.000, [9] 0.015, [10] 0.000, [11] 0.031, [12] 0.016. 
    Revived Cache: 0

    Wednesday, October 17, 2012 6:21 PM

Answers

  • Figured out it was SQL Server Reporting Services.
    Thursday, October 18, 2012 12:45 AM
  • Im actually still getting these after disabling SSRS.  It is literally spamming my event log multiple times a second.  Not sure if it is something to worry about as it is just an information event, but it seems like have the database engine accessed this much would cause some sort of issue.
    Thursday, December 6, 2012 6:09 PM

All replies

  • Figured out it was SQL Server Reporting Services.
    Thursday, October 18, 2012 12:45 AM
  • I'm getting these too, but all my SSRS services are disabled.  I would love any insight into what they are!
    Wednesday, November 14, 2012 2:33 PM
  • Have any idea on how to disable that specific event from being logged?

    Ricardo Costa

    Friday, November 23, 2012 5:17 AM
  • Im actually still getting these after disabling SSRS.  It is literally spamming my event log multiple times a second.  Not sure if it is something to worry about as it is just an information event, but it seems like have the database engine accessed this much would cause some sort of issue.
    Thursday, December 6, 2012 6:09 PM
  • Upon digging further I looked at what service svchost was running that was creating the log files.  Turned out to be UALSVC, which is the  User Access Logging Service. Turning it off services stopped all logs pertaining to the log files shown above. Not quite sure on if it is safe or needed to turn off this service, I will be checking on that next. Hope this helps those seeing the logs.
    • Proposed as answer by sutyak Monday, November 18, 2013 4:16 PM
    Thursday, December 6, 2012 9:21 PM
  • The following KB explains a fix for this issue, yes it is only in japanese (use google translate if needed) if you require usage of the UALs on any windows DC

    http://support.microsoft.com/kb/2900773/ja

    Do mind the following actions had been done before as well:
    Windows update cleanup, using disk cleanup from the desktop experience feature and adding the Network Service account with full rights on the C:\windows\system32\LogFiles\Sum directory
    Friday, October 10, 2014 1:24 PM