Microsoft SQL Server Error Log Scanning

  • Another thing you could try is a powershell script to pull the logs from a collection of SQL servers and email the filtered results to yourself.

  • I do like the idea of removing the cursor. Either an update as already suggested or the SQLServerName column could be changed to use a default:

    [SQLServerName] [nvarchar](150) NULL DEFAULT @@servername

  • michael.wanke (2/14/2011)


    I do like the idea of removing the cursor. Either an update as already suggested or the SQLServerName column could be changed to use a default:

    [SQLServerName] [nvarchar](150) NULL DEFAULT @@servername

    Interesting but not sure if this change will work on a server with several instances installed.

    Rudy

  • abacrotto (2/14/2011)


    I'm sorry for asking something that simple. Why would you use a Cursor and a loop for updating the server when you can use an SQL UPDATE statement instead ?

    Let's see the chunk of code:

    -- Cycle through the ErrLogData table and insert the server's name

    DECLARE SrvName_Cursor CURSOR FOR

    SELECT [SQLServerName] FROM [ErrorLogStorage].[dbo].[ErrLogData] WHERE [SQLServerName] IS NULL

    OPEN SrvName_Cursor

    FETCH NEXT FROM SrvName_Cursor

    WHILE @@FETCH_STATUS = 0

    BEGIN

    UPDATE [ErrorLogStorage].[dbo].[ErrLogData] SET [SQLServerName] = @@servername

    FETCH NEXT FROM SrvName_Cursor

    END

    CLOSE SrvName_Cursor

    DEALLOCATE SrvName_Cursor

    Am I totally missing something here? Essentially doesn't that CURSOR/WHILE loop only result in the UPDATE running once, if there are any NULLs in the SQLServerName column, and setting the SQLServerName column to @@servername for ALL records regardless of if they already have a value? At which point the cursor shouldn't find any more records and abort. So to get the extact same behavior just change that block to: (Since we know the field will be NULL to start with.)

    UPDATE [ErrorLogStorage].[dbo].[ErrLogData] SET [SQLServerName] = @@servername;

    Also, I'm not sure why you are bothering to check if the table exists before the TRUNCATE TABLE statement:

    -- Remove older data

    IF EXISTS (SELECT * FROM [ErrorLogStorage].[dbo].[ErrLogData])

    BEGIN

    TRUNCATE TABLE [ErrorLogStorage].[dbo].[ErrLogData]

    END

    since if it doesn't the INSERT will fail since there is no ELSE clause to CREATE the table. (It just moves the error from one line to another.)

    Other than that, I think the article is nice and shows a decent way to get at the error log. Thanks!

  • I run something very similar as an SSIS package and pull all the log files from all my servers into a master table. I use xp_readerrorlog with the following parameters

    EXEC master.dbo.xp_readerrorlog 0, 1, NULL, NULL, @startDate, @endDate, N'asc'

    And I run it every night, but with a start date as current date - 2 and an end date as current date + 1. The I merge the results from each server into the master log table.

    On top of that I run it again with EXEC master.dbo.xp_readerrorlog 0, 2, NULL, NULL, @startDate, @endDate, N'asc' to get the SQL Agent logs as well. Those go into another table just for agent logs.

    I like doing this because I run a lot of SQL Servers on SAN, and once a while back we ran into some issues with the SAN Fabric and I used a query from all the server log files that were SAN attached to determine a pattern of the "I/O taking longer than 15 seconds" across the servers.

  • Great Article Rudy.

    anyways people can also use XP_ReadErrorLog 0,1,'string_you_want_To_search'

    like xp_readerrorlog 0,1,'error'

    provided you are using SQL Server 2005+ versions

    for earlier version this would be a good option.

    Regards,
    Sarabpreet Singh ๐Ÿ˜Ž
    Sarabpreet.com
    SQLChamp.com
    Twitter: @Sarab_SQLGeek

  • Sarab. (2/15/2011)


    Great Article Rudy.

    anyways people can also use XP_ReadErrorLog 0,1,'string_you_want_To_search'

    like xp_readerrorlog 0,1,'error'

    provided you are using SQL Server 2005+ versions

    for earlier version this would be a good option.

    Thanks Sarab.

    Nicely done. Your idea should make it easier to collect the data needed. Once we get rid of our SQL 2000 servers I will update my code.

    Rudy

    Rudy

  • Thanks for the helpful script.

    Jason...AKA CirqueDeSQLeil
    _______________________________________________
    I have given a name to my pain...MCM SQL Server, MVP
    SQL RNNR
    Posting Performance Based Questions - Gail Shaw[/url]
    Learn Extended Events

  • I just donโ€™t understand....

    From

    CREATE TABLE [dbo].[ErrLogData](

    [LogID] [int] IDENTITY(1,1) NOT NULL,

    [LogDate] [datetime] NULL,

    [ProcessInfo] [nvarchar](50) NULL,

    [LogText] [nvarchar](4000) NULL,

    [SQLServerName] [nvarchar](150) NULL,

    PRIMARY KEY CLUSTERED

    (

    [LogID] ASC

    )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]

    ) ON [PRIMARY]

    SET STATISTICS IO ON

    GO

    -- Remove older data

    IF EXISTS (SELECT * FROM [ErrorLogStorage].[dbo].[ErrLogData])

    BEGIN

    TRUNCATE TABLE [ErrorLogStorage].[dbo].[ErrLogData]

    END

    DECLARE @SQLCmd VARCHAR(1024)

    SELECT @SQLCmd = 'Insert Into [ErrorLogStorage].dbo.ErrLogData (LogDate, ProcessInfo, LogText) Exec master..xp_readerrorlog'

    EXEC (@SQLCmd)

    -- Cycle through the ErrLogData table and insert the server''s name

    DECLARE SrvName_Cursor CURSOR FOR

    SELECT [SQLServerName] FROM [ErrorLogStorage].[dbo].[ErrLogData] WHERE [SQLServerName] IS NULL

    OPEN SrvName_Cursor

    FETCH NEXT FROM SrvName_Cursor

    WHILE @@FETCH_STATUS = 0

    BEGIN

    UPDATE [ErrorLogStorage].[dbo].[ErrLogData] SET [SQLServerName] = @@servername

    FETCH NEXT FROM SrvName_Cursor

    END

    CLOSE SrvName_Cursor

    DEALLOCATE SrvName_Cursor

    GO

    SET STATISTICS IO OFF

    GO

    Table 'ErrLogData'. Scan count 1, logical reads 2, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 0, logical reads 225, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'Worktable'. Scan count 1, logical reads 232, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'Worktable'. Scan count 0, logical reads 2, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 1, logical reads 2, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 1, logical reads 32, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'Worktable'. Scan count 0, logical reads 0, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 1, logical reads 9, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    To

    SET STATISTICS IO ON

    GO

    -- Remove older data

    IF EXISTS (SELECT * FROM [ErrorLogStorage].[dbo].[ErrLogData])

    BEGIN

    TRUNCATE TABLE [ErrorLogStorage].[dbo].[ErrLogData]

    END

    INSERT

    INTO [ErrorLogStorage].dbo.ErrLogData

    (

    LogDate

    ,ProcessInfo

    ,LogText

    )

    EXEC master.dbo.xp_readerrorlog

    UPDATE [ErrorLogStorage].[dbo].[ErrLogData]

    SET [SQLServerName] = @@SERVERNAME

    SET STATISTICS IO OFF

    GO

    Table 'ErrLogData'. Scan count 1, logical reads 2, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 0, logical reads 225, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'Worktable'. Scan count 1, logical reads 232, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 1, logical reads 32, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Or

    CREATE TABLE [dbo].[ErrLogData](

    [LogID] [int] IDENTITY(1,1) NOT NULL,

    [LogDate] [datetime] NULL,

    [ProcessInfo] [nvarchar](50) NULL,

    [LogText] [nvarchar](4000) NULL,

    [SQLServerName] [nvarchar](150) DEFAULT(@@SERVERNAME) NOT NULL,

    PRIMARY KEY CLUSTERED

    (

    [LogID] ASC

    )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]

    ) ON [PRIMARY]

    SET STATISTICS IO ON

    GO

    -- Remove older data

    IF EXISTS (SELECT * FROM [ErrorLogStorage].[dbo].[ErrLogData])

    BEGIN

    TRUNCATE TABLE [ErrorLogStorage].[dbo].[ErrLogData]

    END

    INSERT

    INTO [ErrorLogStorage].dbo.ErrLogData

    (

    LogDate

    ,ProcessInfo

    ,LogText

    )

    EXEC master.dbo.xp_readerrorlog

    SET STATISTICS IO OFF

    GO

    Table 'ErrLogData'. Scan count 1, logical reads 0, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'ErrLogData'. Scan count 0, logical reads 225, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    Table 'Worktable'. Scan count 1, logical reads 232, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0.

    ?

  • Very helpful article.

    One thing that I notice is that update of log table to include @@servername is not not necessary as the command xp_readerrorlog is always executed on the same server.

    we can effectively use @@servername in the select clause

    SELECT

    ,[LogID]

    ,[LogDate]

    ,[ProcessInfo]

    ,[LogText]

    ,SQLServerName=@@ServerName

    FROM [ErrorLogStorage].[dbo].[ErrLogData]......

  • Looks nice and easy. Great for an Implementation Engineer who is not a DBA, but would benefit from quickly checking the SQL Error Log if errors crop up during an implementation.

  • Good article. Updating the SQLServerName column could just as easily be updated in real-time through a default constraint:

    CREATE TABLE [dbo].[ErrLogData](

    [LogId] [int] IDENTITY(1,1) NOT NULL,

    [LogDate] [datetime] NULL,

    [ProcessInfo] [nvarchar](50) NULL,

    [LogText] [nvarchar](4000) NULL,

    [SQLServerName] [nvarchar](150) NOT NULL,

    PRIMARY KEY CLUSTERED

    (

    [LogId] ASC

    )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]

    ) ON [PRIMARY]

    GO

    ALTER TABLE [dbo].ErrLogData] ADD CONSTRAINT [DF_dbo_ErrLogData_SQLServerName] DEFAULT (@@servername) FOR [SQLServerName]

    GO

    This way you could set up an SSIS job to loop through your more critical instances.


    James E Bothamley
    Sr DBA
    Supreme Court of Wyoming
    JBothamley@Courts.State.WY.US
    JamesBothamley@Wyoming.Com

    "Once in a while you can get shown the light
    in the strangest of places if you look at it right"

    JG 1942-1995 RIP

  • Please pay attention: this stored procedure, xp_readerrorlog, can hang and you cannot kill it's process from SQL.

    I am experimenting now with sp_readerrorlog.

  • That's true Youri, but I'm pretty sure that was fixed at some point in the 2005 and 2008 builds. Somewhere between SP3 and SP4 for 2005 if I remember correctly.

  • Unfortunately, it has not been fixed... I don't have the global view, but I guess that this issue has not been fixed AT ALL.

    I manage about 100 SQL Server instances from 2000 to 2012 and at the moment I get this problem with 2005 SP4 and 2008 SP1; earlier I had the same with other versions.

    Even more bad information: such processes not only cannot be killed but also caused high CPU percentages. The only way to get rid of them is to restart SQL. But this is not always a good solution for production environments.

Viewing 15 posts - 16 through 30 (of 34 total)

You must be logged in to reply to this topic. Login to reply