Audit who (account) stopped or started SQL services (Agent/MSSQL)

  • timber

    Valued Member

    Points: 67

    Dears,

    The only way I've found up until today is to audit this externally on Windows level. But I'd like to do this within SQL. I cannot find anything in the default trace that explains who did it, nor in the sql errorlog. So I'm a bit stuck here; Anybody ever set this up?

    Thanks,

    Tim

  • John Mitchell-245523

    SSC Guru

    Points: 148744

    Tim

    I can't see how you could do this within SQL Server, since starting or stopping a service isn't (necessarily) a SQL Server operation.  I think the best you can hope for is to devise some sort of logger that automatically writes certain events from the Windows event log into a SQL Server table.  Of course, that will only work if SQL Server is actually running, so maybe it would be better to pull in the events you want with a stored procedure.  I don't know how you do that, but I'm sure someone out there has done it before, if you search!

    John

  • timber

    Valued Member

    Points: 67

    True, seems like auditing the service control manager is the only way to do it. But that is from the Windows operating system. Seems to end up in the Windows Security Log.

Viewing 3 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply