I need to determine when, and by whom, a SQL Server was shutdown using the osql command. The osql command takes user name and password input. Are there any specific Windows Event logs generated to identify the user, time etc.?

  • I think you mean a T-SQL SHUTDOWN executed by any application using SQL authentication, not just OSQL (long deprecated). The provided SQL login will be recording the SQL Server error log along with the time. If you are looking for additional information, add it to your question.
    – Dan Guzman
    Mar 15, 2020 at 12:15

1 Answer 1


As mentioned by Dan Guzman if you are using the T-SQL SHUTDOWN command to shut down SQL Server, you see see the details with username in two places:

SQL Server Error Log

Date 3/15/2020 7:44:16 PM Log SQL Server (Archive #1 - 3/15/2020 7:44:00 PM)

Source spid67

Message Server shut down by NOWAIT request from login domaninName\Username.

Windows Event Log

Event Id: 6006

Server shut down by NOWAIT request from login domaninName\Username.

If you are stopping SQL Server from configuration manager, services in the control panel or command prompt, you will only get the stop time but not the user who initiated the stop command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.