Re-Started Server

Question

Re-Started Server

Nita Reddy

SSCarpal Tunnel

Points: 4182
More actions
January 20, 2009 at 1:22 pm

#128152

Someone restarted SQL server how can I track him/her?
Is there anyway?
Nita

Viewing 9 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic. Login to reply

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 1

Someone with admin rights, that much I can tell you. Not sure of the default trace would capture who, but I'd start there. There is a function in SQL Server you can use to load the trace data into a SQL table, unfortunately, you'll need to look in BOL or this site to find it as I can't remember the name of it.

Nita Reddy SSCarpal Tunnel Points: 4182 More actions · Answer 2

Does anyone know how to track it, is anywhere logged in history table.

Gail Shaw SSC Guru Points: 1004504 More actions · Answer 3

It should be in the default trace. I think Audit Server Shutdown is an event (haven't checked though). The function to get trace data into a table is fn_trace_gettable

The other place to look is the windows event log. It should have a record of the service stopping and, if someone did that from the service control panel, or by using net stop or similar, it will be logged in the event log and might have the username.

Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass

David Benoit SSC-Dedicated Points: 34562 More actions · Answer 4

Being that the trace that would contain the shutdown would not be the current default trace you could query just that file. So, run select * from systraces to find out where the default trace (trace id 1) is dumping to. Then browse that folder to find the file name of the trace that was running during the time of the shutdown. You can then use the following query to read that file. Query is from BOL;

USE AdventureWorks;

GO

SELECT * INTO temp_trc

FROM fn_trace_gettable('c:\temp\my_trace.trc', default);

GO

David

@SQLTentmaker

“He is no fool who gives what he cannot keep to gain that which he cannot lose” - Jim Elliot

Nita Reddy SSCarpal Tunnel Points: 4182 More actions · Answer 5

Its SQL 2000

It cannot find systraces table in system table

Lynn Pettis SSC Guru Points: 442467 More actions · Answer 6

Unfortunately, we have been giving you SQL Server 2005 answers because you posted your question in a SQL Server 2005 forum.

I don't think you will be able to figure out who restarted your server at this point.

Another question here, though, did SQL Server itself restart or did the server reboot on you? I ask this question as I had a development server reboot on me during the day once and it was the management software on the server that did it. It supposedly detected hung CPU's and restarted the server.

If SQL Server was stopped and started but the server did not reboot, then you can narrow your search to those individuals that have sysadmin rights to SQL Server and/or access to sa.

Nita Reddy SSCarpal Tunnel Points: 4182 More actions · Answer 7

Thanks it was one of the use who had sysadmin access.

But atleast I learn today from SQL 2005 point of view thanks a lot

RPSQL Hall of Fame Points: 3229 More actions · Answer 8

Go to that server->control pannel->Administrative tools->Event viewer->system logs...You can get all the information like who stopped and started the service (see the records with "source" column = service control manager),what time and much more..