April 9, 2009 at 6:03 am
Hi,
I have a SQL job set up to cycle the errorlog on my SQL servers everyday, I have also set the maximum number of logs to be retained to 14. This I reckon gives me enough logs to find any issues and keeps them to a reasonable size.
I have spotted that on all but one of my SQL 2000 servers some of the logs are missing. I have the current log and then
Archive #1 (8 april - 9 april)
Archive #2 (7 april - 8 april)
Archive #3 (6 april - 7 april)
Missing 3 april to 5 april
Archive #4 (2 april - 3 april)
Archive #8 (1 april - 2 april)
Archive #9 (31 mar - 1 april)
Archive #10 (30 mar - 31 mar)
Archive #11 (29 mar - 30 mar)
Archive #12 (28 mar - 29 mar)
All a bit of a worry, any ideas as to what might have happened??
I addition and I don't know if it is connected, a couple of the servers are now extremely slow when logging in using SQL authentication.
Any suggestions very welcome.
Archive #13 (27 mar - 28 mar)
Archive #14 (26 mar - 27 mar)
April 9, 2009 at 8:02 am
Doing only weekday recycles???
-- You can't be late until you show up.
April 9, 2009 at 8:46 am
Recycles everyday around 00:00 hrs
April 9, 2009 at 8:55 am
Can you view the logs of the job for Saturday and Sunday? It looks like you only do weekdays. Right-click on the job and view job history (or double click the job and look at schedules). Maybe that'll point to something.
-- You can't be late until you show up.
April 9, 2009 at 8:58 am
The job is scheduled to run everyday (including weekends)
April 9, 2009 at 9:07 am
Are you sure the job ran? no server restarts? Also, if you look in the logs, do the entries appear to be contiguous?
That is strange. Have you checked the recycle bin, made sure that no one deleted them?
April 9, 2009 at 9:07 am
tosscrosby (4/9/2009)
Can you view the logs of the job for Saturday and Sunday?
-- You can't be late until you show up.
April 9, 2009 at 9:41 am
Terry, cannot see the missing logs anywhere.
Steve, the sequence of the logs on one server as an example is
Current log 09 april 00:13 hrs to present
archive #1 08 april 18:07 hrs to 09 april 00:13 hrs (server was rebooted deliberately, unrelated issue)
archive #2 08 april 00:13 hrs to 08 april 18:01 hrs
archive #3 07 april 00:13 hrs to 08 april 00:13hrs
archive #4 06 april 00:13 hrs to 07 april 00:13hrs
archive #5 02 april 00:13 hrs to 03 april 00:13hrs
archive #6 missing
archive #7 missing
archive #8 missing
archive #9 01 april 00:13 hrs to 02 april 00:13hrs
archive #10 31 mar 00:13 hrs to 01 april 00:13hrs
archive #11 30 mar 00:13 hrs to 31 mar 00:13hrs
archive #12 29 mar 00:13 hrs to 30 mar 00:13hrs
archive #13 28 mar 00:13 hrs to 29 mar 00:13hrs
archive #13 27 mar 00:13 hrs to 28 mar 00:13hrs
On the server there is a file ErrorLogTemp that contains log entries for 03 april 00:13 to 03 April 09:18
The sequence is the same on another server other than the errorlogtemp contains log entries for 03 april 00:13 to 03 April 09:14
April 9, 2009 at 9:54 am
It looks like the logs are contiguous, just not recycled every day.
You want to check the last entry in log 9, the first in log 5, are the times matching?
Perhaps there were no log entries on those days? Or were there? You need to look inside the logs, not at the file times.
April 9, 2009 at 9:58 am
Steve,
5 and 9 follow on, 4 and 5 don't, or so it appears. I am checking the individual logs for the missing entries. We operate a 24/7 business, so I can't beleive there would be no log entries.
All very curious.
April 9, 2009 at 10:08 am
That is curious.
I still suspect that something weird happened in the job rather than the logging, but I would like to know if the entries are contiguous.
Is this a new job?
Are the files named errorlog.1, errorlog.2, etc.? Any missing in the sequence?
April 9, 2009 at 10:32 am
The job has been running for a long time.
On the server we see
ErrorLog
ErrorLog.1
ErrorLog.2
ErrorLog.3
ErrorLog.4
ErrorLog.5
ErrorLog.9
ErrorLog.10
ErrorLog.11
ErrorLog.12
ErrorLog.13
ErrorLog.14
and ErrorLogTemp
Provided by bit of doohickery has got me the min and max dates from each file the sequence is as follows.
LogStartEnd
current09/04/2009 00:1309/04/2009 17:06
#108/04/2009 18:0709/04/2009 00:13
#208/04/2009 00:1308/04/2009 18:01
#307/04/2009 00:1308/04/2009 00:13
#406/04/2009 00:1307/04/2009 00:13
#502/04/2009 00:1303/04/2009 00:13
#6No log
#7No log
#8No log
#901/04/2009 00:1302/04/2009 00:13
#1031/03/2009 00:1301/04/2009 00:13
#1130/03/2009 00:1331/03/2009 00:13
#1229/03/2009 00:1330/03/2009 00:13
#1328/03/2009 00:1329/03/2009 00:13
#1427/03/2009 00:1328/03/2009 00:13
ErrorLogTemp03/04/2009 00:1303/04/2009 09:18
Looks like a mystery to me. Must go now as the easter bank holiday is upon us and the traffic is horrendous.
As an aside, 2 of the servers with this errorlog issue have started to run very slow when using SQL authentication and this (apparently) may have started sometime during the period where the logs are missing. Hmmmmmm
April 10, 2009 at 8:02 am
From what you posted, it looks like it is contiguous, but the logs in th emissing area just didn't have entries. This though, is curious since you should have backups running and/or maintenance jobs running that would log a little information.
I also suggest you change your log cycle to weekly. This is how I have done even the busiest servers I have managed, and the logs were not too big to deal with.
Chris
Learning something new on every visit to SSC. Hoping to pass it on to someone else.
Viewing 13 posts - 1 through 12 (of 12 total)
You must be logged in to reply to this topic. Login to reply