Re: Warning/Error Message

Hello Andy,

Thank you for posting in the SBS newsgroup.

Also, many thanks for Dirk-Thomas's great input.

According to your description, I understand that you received the "Warning
312" and "Error 318" messages on the SBS 2003 Server. If I have
misunderstood your concern, please don't hesitate to let me know.

To narrow down this issue, please refer to the following information:

Event ID: 312 NOTE: Some events may have been missed.

This means SQLAgent$SBSMONITORING is unable to read local event log, it can
happen if you clear down the Event log, it also happen if the
readeventlog() call fails because the Buffer it uses to read the Event log
information is not large enough, it then resizes the buffer the next time
it makes the call, with the information provided in the previous failure,
so it is a fairly benign error and can be safely ignored, unless it is
happening constantly.

Event ID: 318 Reason: The Event log file has changed between read
operations.

- When the SQL Server wants to write events to the event log, someone
clears it. To warn the user that some events may have been lost, this event
is logged. It is followed by information Event ID 311 and then by warning
Event ID 312.


Additionally, please refer to the following KB article:

811484 PRB: SQL Server Agent May Report Event ID: 318 Error After an
http://support.microsoft.com/?id=811484


I hope this helps. If you have any questions or concerns, please do not
hesitate to let me know. I am always happy to be of further assistance.

Best regards,

Nathan Liu (MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------
>From: "Dirk-Thomas Brown" <youhadtoask@xxxxxxxxxxx>
>References: <9AD95517-BBF1-4C5D-AB57-71E4D9BF1BA9@xxxxxxxxxxxxx>
>Subject: Re: Warning/Error Message
>Date: Tue, 14 Jun 2005 10:15:24 -0700
>Lines: 49
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>X-RFC2646: Format=Flowed; Original
>Message-ID: <uRwBoSQcFHA.2980@xxxxxxxxxxxxxxxxxxxx>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: adsl-66-123-75-67.dsl.pltn13.pacbell.net 66.123.75.67
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:127262
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>Not to worry, the event logs were simply deleted or overwritten before the
>SQL instance could document the changes. Happens to me every time I delete
>the event logs...
>
>Dirk-Thomas
>
>"Northwest Upgrades Plus" <andyn@xxxxxxxxxxxxxxxxxx(donotspam)> wrote in
>message news:9AD95517-BBF1-4C5D-AB57-71E4D9BF1BA9@xxxxxxxxxxxxxxxx
>>I keep getting the following Warning and Error Message on my SBS 2003
>> Application Event Viewer and have no idea what it means or how to fix
it.
>> The
>> links do not provide any help either. Any help would be greatly
>> appreciated.
>>
>> Event Type: Warning
>> Event Source: SQLAgent$SBSMONITORING
>> Event Category: Alert Engine
>> Event ID: 312
>> Date: 6/13/2005
>> Time: 8:09:41 PM
>> User: N/A
>> Computer: MAINSERVER
>> Description:
>> Successfully re-opened the local eventlog - NOTE: Some events may have
>> been
>> missed.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Error
>> Event Source: SQLAgent$SBSMONITORING
>> Event Category: Alert Engine
>> Event ID: 318
>> Date: 6/13/2005
>> Time: 8:09:41 PM
>> User: N/A
>> Computer: MAINSERVER
>> Description:
>> Unable to read local eventlog (reason: The event log file has changed
>> between read operations).
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> --
>> Thanks for your help.
>
>
>

.

Relevant Pages

  • Re: convert/copy local profile to Roaming, got a few questions:
    ... To avoid the event log warning entry in the System Event log, ... install Update for Windows XP SP2. ...
    (microsoft.public.windows.server.migration)
  • OMCI - Event Log: Chassis Intrusion Detected?
    ... switch that changes a BIOS setting when you open the ... option for "Chassis Intrusion Detection" and you can ... >In nosing about my Event Log, ... following "Warning" repeated at ...
    (microsoft.public.windowsxp.security_admin)
  • Re: SCECLI 1202
    ... application event log. ... Security policies are propagated with warning. ... original file, but continue to get the same error. ...
    (microsoft.public.win2000.security)
  • Re: GAL update problem
    ... their is no replication error or any error in event log. ... An Warning Event occured. ... it is quit Okay in Domain BB. ...
    (microsoft.public.exchange.admin)
  • Re: Cant read event logs on Win2003 server
    ... Can you check in the Services applet whether the "Event Log" service is ... This posting is provided "AS IS" with no warranties, ... If the firewall is the service called "Internet Connection Firewall / ... > single service that is not running on Windows Server 2003 when you need it ...
    (microsoft.public.windows.server.security)