Open Event Viewer from SQL Server

Question

Post reply

Open Event Viewer from SQL Server

khushbu

SSCarpal Tunnel

Points: 4591
More actions
May 21, 2012 at 12:11 am

#256151

Working in restricted environment is pain.. and not having access to windows server is double pain..
Sometimes, I need to check eventviewer for any errors etc.. and to check this i have to contact windows admin with details about what i need to check, why and where too (?..?)..
Tired of this, hence was thinking if there is a way to open eventviewer using SQL Server, xp_cmdshell?
Can you share some light.. any pre requisite.. etc
Thanks

Viewing 15 posts - 1 through 14 (of 14 total)

You must be logged in to reply to this topic. Login to reply

derek.colley SSCrazy Eights Points: 8040 More actions · Answer 1

Yes, execute:

xp_cmdshell 'eventvwr.msc', no_output in a new query window.

If this fails prefix with c:\windows\system32.

---

Note to developers:
CAST(SUBSTRING(CAST(FLOOR(NULLIF(ISNULL(COALESCE(1,NULL),NULL),NULL)) AS CHAR(1)),1,1) AS INT) == 1
So why complicate your code AND MAKE MY JOB HARDER??!:crazy:

Want to get the best help? Click here https://www.sqlservercentral.com/articles/forum-etiquette-how-to-post-datacode-on-a-forum-to-get-the-best-help (Jeff Moden)
My blog: http://uksqldba.blogspot.com
Visit http://www.DerekColley.co.uk to find out more about me.

khushbu SSCarpal Tunnel Points: 4591 More actions · Answer 2

derek.colley (5/21/2012)
Yes, execute:
xp_cmdshell 'eventvwr.msc', no_output in a new query window.
If this fails prefix with c:\windows\system32.

I already tried this .. strangely nothing happens and query keep on executing .. and after 9 min.. I killed it...

I'm SA on the box and logged in with WIN account..

Did it worked for you?

Eugene Elutin SSC Guru Points: 59322 More actions · Answer 3

khushbu (5/21/2012)
derek.colley (5/21/2012)
Yes, execute:
xp_cmdshell 'eventvwr.msc', no_output in a new query window.
If this fails prefix with c:\windows\system32.
I already tried this .. strangely nothing happens and query keep on executing .. and after 9 min.. I killed it...
I'm SA on the box and logged in with WIN account..
Did it worked for you?

Are you logged onto SQL Server box or you connect to SQL Server from your PC using SSMS?

_____________________________________________
"The only true wisdom is in knowing you know nothing"
"O skol'ko nam otkrytiy chudnyh prevnosit microsofta duh!":-D
(So many miracle inventions provided by MS to us...)

How to post your question to get the best and quick help[/url]

khushbu SSCarpal Tunnel Points: 4591 More actions · Answer 4

Eugene Elutin (5/21/2012)
khushbu (5/21/2012)
derek.colley (5/21/2012)
Yes, execute:
xp_cmdshell 'eventvwr.msc', no_output in a new query window.
If this fails prefix with c:\windows\system32.
I already tried this .. strangely nothing happens and query keep on executing .. and after 9 min.. I killed it...
I'm SA on the box and logged in with WIN account..
Did it worked for you?
Are you logged onto SQL Server box or you connect to SQL Server from your PC using SSMS?

Trying this on my local instance.. so as not to create any hurdles....

Eugene Elutin SSC Guru Points: 59322 More actions · Answer 5

khushbu (5/21/2012)
Eugene Elutin (5/21/2012)
khushbu (5/21/2012)
derek.colley (5/21/2012)
Yes, execute:
xp_cmdshell 'eventvwr.msc', no_output in a new query window.
If this fails prefix with c:\windows\system32.
I already tried this .. strangely nothing happens and query keep on executing .. and after 9 min.. I killed it...
I'm SA on the box and logged in with WIN account..
Did it worked for you?
Are you logged onto SQL Server box or you connect to SQL Server from your PC using SSMS?
Trying this on my local instance.. so as not to create any hurdles....

Sorry, I'm not sure if this is definite answer.

Are you connecting to Sql Server instance which is installed on your local PC, or you connecting remote SQL Server instance from your local PC?

_____________________________________________
"The only true wisdom is in knowing you know nothing"
"O skol'ko nam otkrytiy chudnyh prevnosit microsofta duh!":-D
(So many miracle inventions provided by MS to us...)

How to post your question to get the best and quick help[/url]

khushbu SSCarpal Tunnel Points: 4591 More actions · Answer 6

Eugene Elutin (5/21/2012)
khushbu (5/21/2012)
Eugene Elutin (5/21/2012)
khushbu (5/21/2012)
derek.colley (5/21/2012)
Yes, execute:
xp_cmdshell 'eventvwr.msc', no_output in a new query window.
If this fails prefix with c:\windows\system32.
I already tried this .. strangely nothing happens and query keep on executing .. and after 9 min.. I killed it...
I'm SA on the box and logged in with WIN account..
Did it worked for you?
Are you logged onto SQL Server box or you connect to SQL Server from your PC using SSMS?
Trying this on my local instance.. so as not to create any hurdles....
Sorry, I'm not sure if this is definite answer.
Are you connecting to Sql Server instance which is installed on your local PC, or you connecting remote SQL Server instance from your local PC?

Connecting to SQL Server installed on my local PC.

SQL 2008 R2 SP1 Standard Edition x64

Windows 7 Enterprise Ed SP1 x64

derek.colley SSCrazy Eights Points: 8040 More actions · Answer 7

Sorry for the delay in replying, I've just tested the command I posted and I get the same problem as you - the query hangs.

Should have mentioned I had to enable xp_cmdshell using sp_configure first!

I suspect this is due to SQL Server not having the correct permissions to launch the application. Or maybe something like CLR components needs enabling first?

Anyway apologies if I led you up the garden path.

---

Note to developers:
CAST(SUBSTRING(CAST(FLOOR(NULLIF(ISNULL(COALESCE(1,NULL),NULL),NULL)) AS CHAR(1)),1,1) AS INT) == 1
So why complicate your code AND MAKE MY JOB HARDER??!:crazy:

Want to get the best help? Click here https://www.sqlservercentral.com/articles/forum-etiquette-how-to-post-datacode-on-a-forum-to-get-the-best-help (Jeff Moden)
My blog: http://uksqldba.blogspot.com
Visit http://www.DerekColley.co.uk to find out more about me.

Eugene Elutin SSC Guru Points: 59322 More actions · Answer 8

It's hanging up because it's waiting for output.

Try:

exec xp_cmdshell 'start c:\windows\system32\eventvwr.msc'

The above should return.

Then check in Task Manager, you will see MMC.EXE process running.

You will not be able to see GUI, as it xp_cmdshell runs cmd as service under SQL Server.

_____________________________________________
"The only true wisdom is in knowing you know nothing"
"O skol'ko nam otkrytiy chudnyh prevnosit microsofta duh!":-D
(So many miracle inventions provided by MS to us...)

How to post your question to get the best and quick help[/url]

HowardW One Orange Chip Points: 29109 More actions · Answer 9

It's not to do with permissions. In modern versions of Windows, you can't interact with the UI associated with the SQL Server Service Process - remember that XP_CMDSHELL is running the command within the service, it's not associated with the logged on user to the machine, or the SQL connection user. All you can return is what comes out via the standard output in the command shell. All that's happening here is that it's loading the UI in a virtual desktop that you can't see and sitting there as an open task.

I assume what you're after is to be able to gather the events and query them in SQL? Might be worth having a look at the below:

http://www.mssqltips.com/sqlservertip/1915/how-to-automatically-monitor-windows-event-log-from-sql-server/

Having said that, if your admin's give you full access to XP_CMDSHELL within the context of a local admin, they may as well grant you access to RDP.

Gazareth One Orange Chip Points: 27737 More actions · Answer 10

You can view the Windows event logs in the SQL Log File viewer - at least, I can!

khushbu SSCarpal Tunnel Points: 4591 More actions · Answer 11

HowardW (5/21/2012)
It's not to do with permissions. In modern versions of Windows, you can't interact with the UI associated with the SQL Server Service Process - remember that XP_CMDSHELL is running the command within the service, it's not associated with the logged on user to the machine, or the SQL connection user. All you can return is what comes out via the standard output in the command shell. All that's happening here is that it's loading the UI in a virtual desktop that you can't see and sitting there as an open task.
I assume what you're after is to be able to gather the events and query them in SQL? Might be worth having a look at the below:
http://www.mssqltips.com/sqlservertip/1915/how-to-automatically-monitor-windows-event-log-from-sql-server/
Having said that, if your admin's give you full access to XP_CMDSHELL within the context of a local admin, they may as well grant you access to RDP.

At first glance it seems like this should work for me.. will study in deep tomorrow.

Windows server are managed by some other co "X" and they want to restrict access to it.

Sql Server is managed by us for a Client, so we necessarily have all the rights on SQL.. (yea... strange env..)

HowardW One Orange Chip Points: 29109 More actions · Answer 12

Gazareth (5/21/2012)
You can view the Windows event logs in the SQL Log File viewer - at least, I can!

This is indeed correct - just right click on SQL Server Logs and go View->SQL Server and Windows Log.

It's worth pointing out that you can also connect to a remote event viewer log from your local event viewer (Right click the top of the tree->Connect to another computer...)

Matt Miller (4) SSC Guru Points: 124210 More actions · Answer 13

khushbu (5/21/2012)
Working in restricted environment is pain.. and not having access to windows server is double pain..
Sometimes, I need to check eventviewer for any errors etc.. and to check this i have to contact windows admin with details about what i need to check, why and where too (?..?)..
Tired of this, hence was thinking if there is a way to open eventviewer using SQL Server, xp_cmdshell?
Can you share some light.. any pre requisite.. etc
Thanks

There is a way for your admin to give you access to viewing the events remotely (without logging on to the box). As in - run event viewer locally, but connect to the remote machine to read the events. My access is read-only and I have no ability to physically remotely control the server, but I can read the event log.

As far as using xp_cmdshell - that isn't going to work. XP_CMDshell isn't designed to open up interactive programs, so even if it could execute the event viewer, you won't get the UI.

----------------------------------------------------------------------------------
Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?

ricardotoba Newbie Points: 5 More actions · Answer 14

Hi kushbu,

Are you still looking for a SQL translator for Eventvwr log files? I just implemmented one.

Please contact me at ricardotoba@gmail.com

Regards,

Ricardo