System Log User "N/A"

Question

In Event Log, does anyone know why SQL service was restarted, but “USER” info says “N/A”?  See attached.  Do you know a way to find more detailed log related to this EventID 102?  Is there a .log file that might have more info?

Your help is appreciated!

Answer 1

There is SQL Server Agent Log as well you can view it from the SQL Server Management Studio, or you can go to [Drive]\Program Files\Microsoft SQL Server\MSSQL[Version]\MSSQL\Log, then there is the SQLAGENT.OUT, SQLAGENT.1 ... The same information should be on one of that log. However, it also don't contain the user information.

One place you might want to look is the System log on the Event Viewer. There should be a corresponding entry in the system log that would provide the user information.

Answer 2

That entry is for the SQL Server Agent.  What does the MSSQLSERVER entry say below it?

The SQL Server error log will show you why it restarted.

Answer 3

Here’s the SQL log (see attached).  Do you know why Service Control Manager needs to shutdown SQL?  Trying to get to bottom of the restart.

Answer 4

My interpretation is that someone (= a human being) actively stopped SQL Server.

---

Erland Sommarskog, SQL Server MVP, [e-mail]

Answer 5

Then the question is, who?  Application Event Log indicated User "N/A", why?  Any other ways to investigate which human being?

Answer 6

Have you checked the System Event Log? The user name normally would be logged there.

Answer 7

Same bug "N/A" under User.  See attached.  Any other idea?  Would Service Control Manager automatically shutdown SQL?

Answer 8

SQL Agent is stopped along with SQL Server?
Could you please check the similar entry for SQL Server (MSSQLSERVER) and see if you have user name there?

---

Balmukund Lakhani | Please mark solved if I've answered your question, vote for it as helpful to help other users find a solution quicker
--------------------------------------------------------------------------------
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------------------------------------------------------------------
My Blog | Team Blog | @Twitter
Author: SQL Server 2012 AlwaysOn - Paperback, Kindle

Answer 9

By any chance is there earlier entry before that one that have SQL Agent information? Normally in our environment, we got similar entry "The SQL Server Agent (MSSQLSERVER) service entered the stopped state". That has user N/A.

But then before that entry, we normally get another entry on the System event log "The SQL Server Agent (MSSQLSERVER) service was successfully sent a stop control" and that entry has the windows user name.

From the SQL Server error log screen shot, it does look like your SQL Server was restarted, not just the SQL Server agent.

Answer 10

For the record, this how it looks on my machine after that I stopped SQL Server through the SQL Server Configuration Manager:

That is user is N/A. I'm not a Windows guy, so I don't know if it is expected to see the user who pressed the button here, but it could be that it is simply not recorded.

---

Erland Sommarskog, SQL Server MVP, [e-mail]

Answer 11

...

That is user is N/A. I'm not a Windows guy, so I don't know if it is expected to see the user who pressed the button here, but it could be that it is simply not recorded.

---

Erland Sommarskog, SQL Server MVP, [e-mail]

I can confirm this.

This is an issue for a long time now. I think it changed back in Windows 2008. Before that, the Usernames were actually captured for more events.

I can't give you a good reason for it though either.

---

Andreas Wolter | Microsoft Certified Master SQL Server

Blog: www.insidesql.org/blogs/andreaswolter
Web: www.andreas-wolter.com | www.SarpedonQualityLab.com

Answer 12

I found out more on this, in Windows 2003, when I stopped SQL Server Agent, I would get the same system event log as the one posted (Event ID 7036). But then, before that I also got Event ID 7035, which logged the information on who stopped the service:

Unfortunately it looks like, in Windows 2008, event id 7035 is no longer being logged into Windows 2008. For Windows 2008 and later, there is a way to make it logged the user, but it needs to be configured:

http://blogs.technet.com/b/askds/archive/2011/05/06/friday-mail-sack-who-am-i-kidding-more-like-monthly-edition.aspx#svcaudit

Answer 13

Yes, that's precisely what I am seeing for both SQL Agent and SQL Server restart.  "N/A" are showing under User.  I'm on Win Server 2008.  I don't think configuraion setup above is very intuitive.  Is there a way track Event ID to a user?  See screenshot below:

Answer 14

unfortunately EventIDs do not correlate to Users but rather to Events

Event ID 7036 i.e. correlates to "Basic Service Operations": http://technet.microsoft.com/en-us/library/cc756308%28v=ws.10%29.aspx

This is a very Windows specific topic and even version specific. You can find more information on this thread: http://social.technet.microsoft.com/Forums/windowsserver/en-US/10906293-5548-40f2-8f57-9a47f2c1245c/list-of-error-event-id-in-windows-server-2008-r2?forum=winserverDS

---

Andreas Wolter | Microsoft Certified Master SQL Server

Blog: www.insidesql.org/blogs/andreaswolter
Web: www.andreas-wolter.com | www.SarpedonQualityLab.com