Re: error message not being logged to windows event log

From: Sue Hoegemeier (Sue_H_at_nomail.please)
Date: 03/23/04 

Date: Tue, 23 Mar 2004 12:45:44 -0700

Anon restarted SQL Server after making the changes which
solved the problem.
Logging to the Windows event log is enabled by default for
SQL Server. The auditing is logged to the SQL Server error
log and the Windows Application event log if you haven't
changed the default settings. You can find more information
on this in books online under startup options.

-Sue

On Tue, 23 Mar 2004 16:44:50 -0000, "Alan J. McFarlane"
<alanjmcf@yahoo.com.INVALID> wrote:

>Sue Hoegemeier <Sue_H@nomail.please> wrote:
>> On Mon, 22 Mar 2004 15:46:08 -0800, "anon"
>> <anonymous@discussions.microsoft.com> wrote:
>>> I have done that but still it is not being logged. My log in
>>> consists of me opening a new window in Query Analyzer and logging in
>>> with a SQL Server login and password, not through Windows
>>> authentication, though I don't think this would matter....
>>>
>I'm no expert in SQL/MSDE, far from it. But from what I've (remembered of
>what) I've read, I thought the login audit logging only went to file
>LOGS\ERRORLOG and not to the Event Log.
>
>Anyway that's the behaviour I see here: AuditLevel=3 and I get entries in
>the ERRORLOG but nothing apparent in the Event Log. I'm not using SQL
>authentication so the entries are of the form:
> 2004-03-19 21:39:25.81 logon Login succeeded for user 'DOM\usr'.
>Connection: Trusted.
>and if I try sa not using the correct password I get:
> 2004-03-23 16:33:57.51 logon Login failed for user 'sa'.
>
>I may well be wrong on the non logging to the Event Log...but check the
>contents of ERRORLOG anyway to see if the logging is occuring there.
>
>>> Is there anything I'm missing here?
>>>
>> Did you restart SQL Server after changing the audit logins
>> setting?
>>
>Or maybe that has solved it already...

Relevant Pages