I need to know Who restarted SQL Server or What caused automatically to restart SQL Server, I have searched Event viewer for events 17163, 6005, 6006 , 6008 and 6009, but unsuccessful it had returned null, i don't want information like last restart time where i can get it create_date from sys.databases of tempdb or start_time from sys.dm_os_sys_info.
Add a comment
|
1 Answer
What about setting up a server audit with this event : "Audit Server Starts and Stops Event Class" > "The Audit Server Starts and Stops event class occurs when the Microsoft SQL Server service state is modified". Never tried it, but you should be able to knwow which "LoginName" modified the SQL Server state. "EventSubClass" 1 is regarding shutdown.
https://msdn.microsoft.com/en-us/library/ms189244(v=sql.100).aspx
https://msdn.microsoft.com/en-us/library/cc280663(v=sql.100).aspx
