3

I need to know Who restarted SQL Server or What caused automatically to restart SQL Server, I have searched Event viewer for events 17163, 6005, 6006 , 6008 and 6009, but unsuccessful it had returned null, i don't want information like last restart time where i can get it create_date from sys.databases of tempdb or start_time from sys.dm_os_sys_info.

1

What about setting up a server audit with this event : "Audit Server Starts and Stops Event Class" > "The Audit Server Starts and Stops event class occurs when the Microsoft SQL Server service state is modified". Never tried it, but you should be able to knwow which "LoginName" modified the SQL Server state. "EventSubClass" 1 is regarding shutdown.

https://msdn.microsoft.com/en-us/library/ms189244(v=sql.100).aspx

https://msdn.microsoft.com/en-us/library/cc280663(v=sql.100).aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.