I need to determine when, and by whom, a SQL Server was shutdown using the osql command. The osql command takes user name and password input. Are there any specific Windows Event logs generated to identify the user, time etc.?
1 Answer
As mentioned by Dan Guzman if you are using the T-SQL SHUTDOWN command to shut down SQL Server, you see see the details with username in two places:
SQL Server Error Log
Date 3/15/2020 7:44:16 PM Log SQL Server (Archive #1 - 3/15/2020 7:44:00 PM)
Source spid67
Message Server shut down by NOWAIT request from login domaninName\Username.
Windows Event Log
Event Id: 6006
Server shut down by NOWAIT request from login domaninName\Username.
If you are stopping SQL Server from configuration manager, services in the control panel or command prompt, you will only get the stop time but not the user who initiated the stop command.
answered Mar 15, 2020 at 23:59
SHUTDOWNexecuted by any application using SQL authentication, not just OSQL (long deprecated). The provided SQL login will be recording the SQL Server error log along with the time. If you are looking for additional information, add it to your question.