0

A few days ago, some SQL Servers I work with suddenly went down.

I saw this in the logs:

2023-05-20 17:40:50.64 spid51      Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
2023-05-20 17:40:50.78 spid51      Configuration option 'Agent XPs' changed from 1 to 0. Run the RECONFIGURE statement to install.
2023-05-20 17:40:51.03 spid51      Configuration option 'show advanced options' changed from 1 to 0. Run the RECONFIGURE statement to install.
2023-05-20 17:40:52.21 spid9s      Always On: The availability replica manager is going offline because SQL Server is shutting down. This is an informational message only. No user action is required.
2023-05-20 17:40:52.62 spid9s      SQL Server is terminating in response to a 'stop' request from Service Control Manager. This is an informational message only. No user action is required.

All of them have the same logs with some minutes of difference.

I am trying to find if that kind of configuration was applied by an user or was something that happened automatically.

I tried to find some logon events in Windows Event Viewer but found nothing.

So do you know if I can find who did this?

Improve this question
5
  • SQL Server does not record any user info about service startup or shutdown events; check the windows event security/system logs for the same time period.
    – sTTu
    May 23 at 20:14
  • @sTTu If that's the answer, please enter it in the answer box 👇
    – mustaccio
    May 23 at 20:20
  • Have you verified that only the SQL Server instance was shutdown, and not the whole machine itself?
    – J.D.
    May 23 at 21:54
  • Yes, I checked that only the SQL was shutdown. I tried to check the event security/system logs but no info about who logged into the system or did that configuration change. If SQL does not record any user info about service startup or shutdown.. maybe it records who change some configuration?
    – Oscar Carrasco
    May 24 at 0:19
  • Those config changes you see are because the service was shutdown. I.e., somebody stops the database engine, so Agent need to be stopped, which in turn means an turning off agent XPs, which is an advanced option. Also, and FWIW, I checked some other SQL Server logs (default trace and XE system health) and couldn't find anything there either.
    – Tibor Karaszi
    May 24 at 6:42

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.