October 6, 2010 at 9:53 am
How can I tell who stopped SQL Server?
Event logs and ERRORLOG don't indicate the user logged on to the box that stopped the service.
Is there a way to tell who stops a service in Server 2003? Specifically, SQL Server, but really, any service.
October 6, 2010 at 10:34 am
You sure about that? When I stop SQL Server, there is an event logged in the System Log in Event Viewer that is EventID 7035. It says that the system was sent a stop control. The user detail in the User field tells you who sent the control.
October 6, 2010 at 10:36 am
And more to the point, I know that this works because one time we had a production server shut down unexpectedly in the middle of the day. The Stop Control User was a particular admin. I asked him why he stopped the service and he stared blankly at me. When I told him the box, his eyes bugged out -- he tried and failed to install a program that used the DB on that server, and the installer using his account shut down SQL.
October 6, 2010 at 3:02 pm
I just shut down the SQL instance and looked in the System log in the Event viewer. I don't see that EventID at all.
October 6, 2010 at 3:15 pm
Try the application event log.
Shawn Melton
Twitter: @wsmelton
Blog: wsmelton.github.com
Github: wsmelton
Viewing 5 posts - 1 through 4 (of 4 total)
You must be logged in to reply to this topic. Login to reply