SQL Server’s utterly pointless event logging
If you’ve ever run Microsoft SQL Server you’ll probably be aware of its tendency to flood the Application event log with utterly trivial bilge. Yet for all the informational messages it logs, SQL Server never actually seems to log anything important when it happens. I was poring through said log last week (for reasons that will become clear later), and here are some of the most pointless messages that very frequently appear on my server:
- Event 18264 tells me about each individual database that has been backed up, while 18265 immediately afterwards tells me that its log has been backed up. Thrilling!
- Event 15457 will frequently tell me something cryptic like “Configuration option ‘xp_cmdshell’ changed from 1 to 1. Run the RECONFIGURE statement to install.” I have no idea why I should even remotely care about this.
- When it starts up, it will log event 17069 to tell me the SQL Server version, then 17101 to tell me “(c) 2005 Microsoft Corporation”, then, utterly inexplicably, a COMPLETELY SEPARATE event 17103 just to continue with “All rights reserved.”
But is there ANY LOG AT ALL to tell me when a database has been dropped? You know, something that could massively impact the operation of the system and which is apparently not recorded in any persistent log anywhere else?
Microsoft themselves define an event as “any significant occurrence in the system or in a program that requires users to be notified, or an entry added to a log”. I don’t know about you, but I wouldn’t classify an “All rights reserved” notice as ‘significant’, and the deletion of an entire database from a database server as ‘not significant’.
Maybe its just me.
Or maybe the person in charge of SQL Server event logging needs a SEVERE KICK UP THE BACKSIDE.