SQL 2012 :: Blocking Alerts Using Event Notifications?
Nov 28, 2014I created a Blocking Event Notification following this article ->[URL=
How do I throttle the alerts so that I only receive one alert per hour instead of 1000?
ADVERTISEMENT
SQL 2012 :: Detailed Deadlock Event Notifications Via Email?
Nov 1, 2015We have (running SQL 2012 Std) and have enabled trace flag 1204 and 1222 for capturing deadlock through extended events. I have enabled deadlock notification through email .But it only send deadlock event occurred notification from the sql server error log . I was wondering if its possible to email the deadlock details they get generated in extended events via DB mail.
View 1 Replies View RelatedNotifications Sent Even If Alerts Are Disabled
Mar 7, 2001Hello all,
Here's the problem I'm trying to solve:
I have several alerts set up and a job setup to notify via email if alerts occur. There are times when I might be doing maintenace on a box that may generate alerts but I don't want to get emailed or paged for these "dummy" alerts. I thought first of setting the enabled column of sysalerts to 0 - that doesn't work. I still get notified. Then I thought I'd set the enabled column in sysjobs for my notification job to 0 while I'm doing the work. But as soon as I re-enable the job I get an alert. It seems that as soon as the job is re-enabled it checks the NT application log and sees that an alert was fired and somehow knows that there was no notification sent so sends one. If I purge the NT application log before re-enabling the job is solves the problem. But that is a very in-ellegant solution and I don't want to loose all the info stored in the event log any way. Does anyone know how SQL SErver aggent keeps track of this stuff? (ie. that an alert was fired but it's response job is disabled and to check once a job is re-enabled to see if any alerts occured while it was disabled?) I did a Profiler trace while re-enabling the job but didn't see anything pertinant in there.
Thanks in advance.
Patrick
Cannot Set Job Alerts On Notifications Tab If A Non-sysadmin User
Jul 20, 2005Platform: Win2000 SP3, SQL 7.00 - 7.00.1063I have a SQL-authenticated user with the following permissions:"Process Administrators" server role"db_owner" and "TargetServersRole" for msdb database"db_owner" for master database.The problem is that when this user opens up any job (i.e. owned by anyuser) in the SQL Server Agent, and goes to the Notifications tab, thefirst three alerts (Email, Page and Net send) are greyed out, i.e.these cannot be set.The other options are available (Write to Windows application eventlog, Automatically delete job).The only way I can achieve this is to give this user the "SystemAdministrators" server role, i.e. sa.But this of course gives absolutely full access, which I don't want.Is there a way for a user to see/change Notifications of jobs whichonly he owns?
View 2 Replies View RelatedSending Alerts ,Email Notifications From SQL To CellPhone
Sep 4, 2001HI,
Does any one know how I could send all the alerts, email notifications from the SQL Server to my Sprint PCS Phone. Is there any software for that. I know that it can be done by MSN mobile. Just checking whether it can be directly sent to my phone rather than going to hotmail which is then forwared to my cell phone. Let me know.
Thanks,
Cinday
Agent Jobs: Trouble Sending Notifications/Alerts
Sep 19, 2007This is on sql server 2005: I created an agent job and I want to be able to notify people by email when it completes and when it fails. I first wanted to test the notification for when it completes. I created an operator and entered the E-mail name. In the job properties, I selected this operator in the Notifications page.
The job runs an ETL process. When I run the job, after it completes,
the email is not sent. This seems straight-forward. The email address is valid, I tested the email address and it does get sent when I do it from Outlook 2007.
Anyone have this problem?
Proper Use Of Event Notifications
Apr 19, 2006Hi.
I'm developing an app that uses Service Broker queues to allow a customer to create "events" that fire using a timer or a query notification. When these events fire, a message is sent to a Service Broker queue for processing. Because there is much managed code involved in processing these messages, I decided to use the External Activator application and an Event Notification to process these messages. My question is "what is the difference between using the External Activator application to launch another application (which simply RECEIVEs a message from the target queue and processes it) and creating a windows service that simply monitors the target queue (with a WAITFOR = -1 clause) and processes it?"
I guess I'm not sure how using the QUEUE_ACTIVATION Event Notification is really helping me.
Thanks,
Chris
Event Notifications Are Not In The SQL Management Studio UI?
Sep 30, 2005hi. can't seem to find the event notifications in the service broker folder of Management Studio.. I can get the information from sys.event_notifications, but it seems odd that event notifications are not in the UI. Hopefully I'm looking in the wrong place?
View 1 Replies View RelatedEvent Notifications: Insufficient System Memory
Feb 20, 2008I'm looking for a sanity check. Service broker and Event Notifications are new to me, so it is possible I'm either abusing or incorrectly using the technology. I'm experimenting with using Event Notifications and Server Broker to log error messages. The process works pretty well as long as I don't do something stupid such as stressing the process by calling raiserror in a loop of a 100000 - twice. It processed for a while, but eventual either SQL Server terminates (sev 25) or I had to force the SQL service to stop by killing it's process via task manager. I could not connect to SQL Server or stop the service normally.
I have several general questions. I think they are good questions. Any thoughts or suggestions would be appreciated.
1) I'm looking into generating deadlock and blocking email alerts. It appears that Event Notification is the way to go since there are very few events and I can respond to the event with an email. Is there a better method to automate blocking and deadlock email alerts that include event details?
2) If I wanted to retain some history of errors for the developers, should Event Notifications be avoided if a high number of errors can be generated by a badly formed T-SQL? Avoid TRC_ERRORS_AND_WARNINGS and USER_ERROR_MESSAGE? (I could tell the developers not to be stupid, but why would that stop them if it does not stop me?)
3) Is there a way to efficiently filter a Event Notification from entering the queue before the Receive statement is called? I get some events that I throw away after receiving them. For example, perhaps I want all events from all non-system databases without having to add a notification for each single non-system database. Or I want all errors with severity 11-17 only?
4) Is there a trick to filter out events from the procedure activated by the event. I tried using raiserror to debug a procedure without thinking. The result was that the queue never was empty because the processing produced more events to process. As a result, I don't use raiserror and use a try-catch to avoid raising errors in the procedure activated.
5) I can receive one message at a time using local variables or receive a batch of messages using a local table. Is a small batch the best way even if there is memory pressure?
6) In the activated procedure I continue processing in a loop until there are no more messages. This seems to be the most efficient. Is this always the case? Should I exit the procedure after a set number (large) of messages have been received? The procedure would activate again to continue processing?
7) Is there any point to using the MAX_QUEUE_READERS setting when processing event notifications? Should it be 1?
8) I currently get the next conversation group id and process its messages within a transaction. Is this a bad idea with event notifications? Should I just call Receive and get the next batch? I don't really care if I lose some messages if things are going badly. Should I avoid wrapping the receive in a transaction?
9) I could run a trace that starts with SQL Server; however, I think my only choice is to log to a file. Is there a way to trace to a table using SQLTrace without running profiler? I would like to automate the process and have the data in a table so that it can be easily queried and parsed for each database/team.
10) Is there a way to fix my process and handle 100000 messages a minute? Is there a way to skip messages when it gets to busy? Can the query generating the messages get throttled - perhaps along with the query designer - before the server gets into trouble? Query the memory used by a queue and drop/create the queue with a delay if there is an issue?
I'm using a single CPU test machine with only 1 GB and 2 GB pagefile and a single disk. OS: Windows 2003 R2 SP2. SQL: 9.0.3054 and on 9.0.3228 (update package 6 just came out today). I could add memory, but I think that would just permit me to queue more message before running into trouble.
I'll add code shortly - length limit.
Problems With Sending Event Notifications To Remote Service
May 10, 2006Hi!
Just set up my first Service Broker test. Wanted to send an Event Notification from one instance to another. Finally, the message arrives but profiler shows that the message is still being continously resent (and rejected as being duplicate). What am I doing wrong?
With best regards,
Artus
--
/* Local Event Source.sql */
USE master
GO
CREATE DATABASE NotificationDB
GO
ALTER DATABASE NotificationDB SET ENABLE_BROKER WITH ROLLBACK IMMEDIATE;
GO
CREATE ENDPOINT BrokerEndpoint
STATE = STARTED
AS TCP
(
LISTENER_PORT = 5554
)
FOR SERVICE_BROKER
(
AUTHENTICATION = WINDOWS,
ENCRYPTION = DISABLED
)
GO
USE NotificationDB
GO
CREATE EVENT NOTIFICATION TestEN
ON DATABASE
FOR CREATE_TABLE
TO SERVICE 'ExpressService', 'AFEDD339-AD3D-4865-AF3C-299B0A0784C6'
GO
CREATE ROUTE ExpressRoute
WITH SERVICE_NAME = 'ExpressService' ,
BROKER_INSTANCE = 'AFEDD339-AD3D-4865-AF3C-299B0A0784C6',
ADDRESS = 'TCP://localhost:5555'
GO
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Pa$$w0rd';
GO
ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY;
GO
USE master
GO
SELECT service_broker_guid FROM sys.databases WHERE database_id = DB_ID()
GO
/* Remote Service.sql */
USE master
GO
CREATE DATABASE Test
GO
ALTER DATABASE Test SET ENABLE_BROKER WITH ROLLBACK IMMEDIATE;
GO
CREATE ENDPOINT BrokerEndpoint
STATE = STARTED
AS TCP
(
LISTENER_PORT = 5555
)
FOR SERVICE_BROKER
(
AUTHENTICATION = WINDOWS,
ENCRYPTION = DISABLED
)
GO
USE Test
GO
CREATE QUEUE ExpressQueue
WITH STATUS = ON
GO
CREATE SERVICE ExpressService
ON QUEUE ExpressQueue
(
[http://schemas.microsoft.com/SQL/Notifications/PostEventNotification]
);
GO
GRANT SEND ON SERVICE::ExpressService
TO [public]
GO
CREATE ROUTE ExpressServiceRoute
WITH SERVICE_NAME = 'ExpressService',
BROKER_INSTANCE = 'AFEDD339-AD3D-4865-AF3C-299B0A0784C6',
ADDRESS = 'LOCAL'
GO
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Pa$$w0rd';
GO
ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY;
GO
SELECT service_broker_guid FROM sys.databases WHERE database_id = DB_ID()
GO
SELECT * FROM sys.endpoints
GO
Event Notifications Don't Fire When Raised By Activated Procedure
Oct 23, 2006I have an activated SP that is issuing PRINT statements.
These are raised as ErrorLog and EventLog events when using SQLProfiler
However if you attach an event notification for ERRORLOG and EVENTLOG, nothing appears in the queue. Any other ERRORLOG or EVENTLOG event caught by profiler is caught by the event notification as expected.
SQL 2012 :: Query Notifications For More Than Just Cache?
Jan 13, 2015All the recommendations I see from Microsoft docs is to limit the use of Query Notifications (QNs) to notifying connected clients when changes to mostly-static reference or configuration data occur, and to keep the number of overall query forms in play and connected clients to a minimum. Any way regarding a more integral use of QNs and Service Broker from a web app to notify n-web servers (farm) of an update to data that could be updated concurrently and quite frequently, or with a system where the technique is used extensively with lots of different query forms?
View 0 Replies View RelatedSQL 2012 :: How To Remove Records From Repository / Alerts
Feb 18, 2014We configured IDERA SQL Safe for backups and restores.we setup an email for notifications. One day we performed manual backup operation for 150 databases from SQL Safe tool. Unnoticed it backed up to C:Backup folder.
We got alerts with the report of backups on C: drive. Then we moved backup files to respective folders.But, I could not clear the records from the report, its been 25 days, still we are receiving the alerts as below.How can I clear this report or to configure or setup anything to avoid this, in future as well.
Below is the sample records from the report. I need this report to be cleared.
Subject: SQL Safe Validation Report
The following files are recorded in the SQLSafe repository, but no longer exist in their locations:
C:BackupLUXOR_DB_GroupEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_InsightEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_IMEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_SiteEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_SiEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_ICEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_vdbEPF_Diff_201402050045 (1 of 1).safe
C:BackupLUXOR_DB_M_SEPF_Diff_201402050045 (1 of 1).safe
SQL 2012 :: Database Mail - Test Email Works But Jobs Won't Send Out Notifications
Oct 19, 2015I am trying to send out notifications when jobs complete (fail or succeed). I have database mail working fine on my DEV server, but I am having issues with it on my PROD server. I am currently having people look into if McAfee may be blocking it.
I am able to send out a test email from SSMS>Management>Database Mail, but when I set a Notification for a job, the job will complete and in the history, it will say "NOTE: Failed to notify 'User' via email."
I have created an Operator and set up Profiles and Accounts, just as I did on my DEV server.
SQL 2012 :: Blocking During Bulk Inserts?
Dec 9, 2014We are noticing a lot of blocking when performing bulk inserts.
Sometimes the lead blocker(s) are blocking inserts into the same tables, but most of the time, it's insert to other tables. So, while bulk insert into table X is running, bulk insert into table Y is blocked from the insert into X.
- We turned off transactions from the application performing the bulk inserts - no change.
- We enabled table locking from the application - no change
- We enabled lock_on_bulk_load on the tables - this seems to have worked; however still see some blocking.
According to the lock_on_bulk article - When you specify table locking for a bulk import operation, a bulk update (BU) lock is taken on the table for the duration of the bulk-import operation, shouldn't we be seeing this BU lock? Instead, we see nothing but LCK_M_X (exclusive table locks).
Just found out that in order get a BU lock, no indexing can exist on the table ... sure be nice if that was in the article!
Also, we saw the exclusive locks happening before we made these changes, meaning it wasn't using the row locks that it should be by default. Assuming we're missing something here with lock escalation. I am profiling just for lock escalation, and it never happens ...
So I guess my pending question at this time is that why when inserting into table X do inserts into table Y get blocked?
SQL 2012 :: Set Statistics XM Off - Blocking From Using Object Explorer
Jul 9, 2014Seen activity like this? If so, where does it come from?
dd hh:mm:ss.mss:00 00:18:32.210
session_id:79
login_name:meme
wait_info:(6ms)IO_COMPLETION
CPU:646,180
tempdb_allocations:2,088
tempdb_current:0
blocking_session_id:NULL
reads:171,237,095
writes1,439,934
physical_reads:637,080
used_memory:2
status:rollback
SQL 2012 :: Blocking In Report Server TempDB
Sep 21, 2015I am seeing select * from sys.sysprocess where blocked<>0 is always the report server
ReportServer.dbo.GetSessionData;1 is blocked by ReportServer.dbo.WriteLockSession;1
We have different reporting servers using same database.
Is it require to rebuild indexes on report server and report server temp db on daily basis?
SQL 2012 :: Track Blocking Details At A Specific Time?
May 28, 2015In sql 2012 i want to track the blocking details at a specific time is any query to get the data ?
View 6 Replies View RelatedSQL 2012 :: Blocking Frequently Report Server TempDB
Aug 27, 2015How to solve the below blocking issue
One of our production server is configured with Always on with sql cluster.
We are getting frequently blocking
Waiting Resource Key Type: Key
WaitType: LCK_M_S
WaitResourceDatabaseName : ReportServerTempDB
WaitingSessionProgramName: Report Server
BlockingSessionProgramName: Report Server
WaitCommandType: Select
WaitingCommandText: Create Procedure dbo.checksessionLoak @sessionID...
SQL 2012 :: Blocking In Report Server Database And Changing Isolation Levels?
Oct 12, 2015We are getting frequently blocking in Report server database.
Is it ok to change isolation level to RCSI for report server database?
SQL 2012 :: Script To Find Out Blocked Sessions And Send Email Whenever It Finds Blocking
Feb 20, 2014I want to implement a script which will run continuously to find out blocked sessions and send an email when ever it finds the blocking.
View 5 Replies View RelatedSQL 2012 :: Sleeping Queries Blocking Rebuild Index And Update Statistics Job In AlwaysOn
Feb 3, 2015At one of your client sides we have configured Always on with synchronous mode.Also we have schedule rebuild index and update statistics job which runs in night every alternate day. the issue is there are more then 100 sleeping queries which is blocking update statistics job.
I have to stop update statistics job manually once i come to office manually.
Once I have killed blocking sleeping query but then other sleeping query blocked it and so on.
SQL 2012 :: What Constitutes A Login Event
Mar 30, 2015I set up a trigger to capture logins at the server level. This is part of some metrics I am putting together to properly set up load testing.
I am not surprised by the number of logins from the application logins, but what does surprise me is the number of logins from the various users that can query the production data.
As an example, my account has 1200+ logins for today only.
My first thought was that a process was set up to use my login by mistake. This also applies to some of the other users.But, there are no processes that are using any login except for the SQL service account or the applications logins.
What constitutes a login event?
[URL]
The SQL Server Service Broker For The Current Database Is Not Enabled, And As A Result Query Notifications Are Not Supported. Please Enable The Service Broker For This Database If You Wish To Use Notifications.
Feb 16, 2008Hello, I receive this error "The SQL Server Service Broker for the current database is not enabled, and as a result query notifications are not supported. Please enable the Service Broker for this database if you wish to use notifications." I attach the database in Management Studio to query and enable the broker using the scrip below but to no avail. ALTER DATABASE DataName SET ENABLE_BROKER ‘''<<------successfulandSELECT is_broker_enabled FROM sys.databases WHERE name = 'Database name' ‘'''<<-------value is 1 Global.asax ... Sub Application_Start(ByVal sender As Object, ByVal e As EventArgs) System.Data.SqlClient.SqlDependency.Start(ConfigurationManager.ConnectionStrings("dataConnectionString1").ConnectionString) End Sub...Web.config ... <connectionStrings> <add name="dataConnectionString1" connectionString="Data Source=.SQLEXPRESS;AttachDbFilename=|DataDirectory|jbp_data.mdf;Integrated Security=True;User Instance=True" providerName="System.Data.SqlClient" /> <add name="ASPNETDBConnectionString" connectionString="Data Source=.SQLEXPRESS;AttachDbFilename=|DataDirectory|ASPNETDB.MDF;Integrated Security=True;User Instance=True" providerName="System.Data.SqlClient" /> </connectionStrings>... Hope you could help. cheers,imperialx
View 1 Replies View RelatedSQL 2012 :: Capturing Historic Deadlock Using Extended Event
Dec 9, 2014I am learning Extended event to capture deadlock which already happened, for this in my SQL SERVER 2012.. I am simulating a deadlock . With [URL]... where given a query to find the deadlock details using extended event here is the code..Retrieve from Extended Events in 2012.
SELECT XEvent.query('(event/data/value/deadlock)[1]') AS DeadlockGraph
FROM ( SELECT XEvent.query('.') AS XEvent
FROM ( SELECT CAST(target_data AS XML) AS TargetData
FROM sys.dm_xe_session_targets st
JOIN sys.dm_xe_sessions s
[code]...
This code creates a deadlock but when i run the above Extended events query to get the details of deadlock, it doesnot display any results.
SQL 2012 :: Profiler Event For Bulk Load Requests?
Jan 27, 2015For Bulk Load requests in SQL server, Are there any specific profiler event? Like the one we have for RPC RPC:Starting and for Batch Requests, we have SQL:BatchStarting.
Are Bulk Load requests that are being monitored through Profiler captured as SQL:Batch... events at the backend?
Are there any new features added in 2012 or 2014 to identify a Bulk request submitted through bcp.exe utility or any other sqlbulkcopy program?
SQL Server 2012 :: Using Xquery To Get Event Data Back From Extended Events?
Feb 25, 2014I am trying to use xquery to get event data back from extended events. I am trying to use some sample data from Grant Fritchey but I am getting null records back. Below is the xml - I just want to retrieve a distinct list of the client_hostname and client_app_name.
<event name="login" package="sqlserver" timestamp="2014-02-19T23:53:54.299Z">
<data name="is_cached"><value>true</value></data><data name="is_dac">
<value>false</value></data><data name="database_id"><value>7</value>
</data><data name="packet_size"><value>8000</value></data><data name="options">
[Code] ....
The query I have that doesn't work is :
WITH xEvents AS
(SELECT object_name AS xEventName,
CAST (event_data AS xml) AS xEventData
FROM sys.fn_xe_file_target_read_file
('C:LoginTraceShared_0*.xel', NULL, NULL, NULL))
SELECT distinct top 1000 xEventName,
xEventData.value('(/event/data[@action_name=''Client_APP_Name'']/value)[1]','varchar') Client_APP_Name,
xEventData.value('(/event/data[@action_name=''Client_Host_Name'']/value)[1]','varchar') Client_Host_Name
FROM xEvents
SQL Server 2012 :: Where To Find List Of Values For Event Data Files
Jan 21, 2015Got following query:
SELECT
event_data.value('(event/data/value)[4]', 'bigint') AS cpu_time,
--database name
event_data.value('(event/data/value)[5]', 'bigint') AS duration,
--estimated cost
--estimated rows
--nest level
[code]...
Basically, is a simple T-SQL query that reads the local file for my already setup extended event sessions. But I can't find the way to retrieve the following attributes as part as the T-SQL query:
--database name
--estimated cost
--estimated rows
--nest level
--object name
I am trying to find a BOL or some MS link with the full list of possible values for event_data.value but can't find one.
SQL Server 2012 :: Capture Statement From Missing Join Predicate Event?
Jan 27, 2015After monitoring using SQL profiler, i found that Missing join predicate event is happening a lot.
The problem is that profiler doesn't allow me to select the textdata to know which SQL statement is causing the issue.
I tried using the spid to check what's that process is running but the problem is that application is running many sqls so when i run
select PROGRAM_NAME,hostname,qt.text from sys.sysprocesses as sps1 CROSS APPLY sys.dm_exec_sql_text(sps1.sql_handle) AS qt
where spid=169
it gets me the SQL being run at that time not the one that causing the event.
Recovery :: Configure Extended Event To Trigger A Mail Whenever Any Event Occurs
Jun 2, 2015Recently we migrated our environment to 2012.
We are planning to implement Xevents in all the servers in place of Trace files and everything is working fine.
Is it possible to configure Extended event to trigger a mail whenever any event (example dead lock) occurs.
I have gone through so many websites but i never find.
DB Engine :: Event Tracing For Windows Failed To Send Event
Oct 25, 2011My SQL Server 2005 SP4 on Windows 2008 R2 is flooded with the below errors:-
Date 10/25/2011 10:55:46 AM
Log SQL Server (Current - 10/25/2011 10:55:00 AM)
Source spid
Message
Event Tracing for Windows failed to send an event. Send failures with the same error code may not be reported in the future. Error ID: 0, Event class ID: 54, Cause: (null).
Is there a way I can trace it how it is coming? When I check input buffer for these ids, it looks like it is tracing everything. All the general application DMLs are coming in these spids.
WMI Event Watcher Task Continual Firing Event When Not Triggered
Apr 8, 2008I have been testing with the WMI Event Watcher Task, so that I can identify a change to a file.
The WQL is thus:
SELECT * FROM __InstanceModificationEvent within 30
WHERE targetinstance isa 'CIM_DataFile'
AND targetinstance.name = 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Backup\AdventureWorks.bak'
This polls every 30 secs and in the SSIS Event (ActionAtEvent in the WMI Task is set to fire the SSIS Event) I have a simple script task that runs a message box).
My understanding is that the event polls every 30 s and if there is a change on the AdventureWorks.bak file then the event is triggered and the script task will run producing the message.
However, when I run the package the message is occurring every 30s, meaning the event is continually firing even though there has been NO change to the AdventureWorks.bak file.
Am I correct in my understanding of how this should work and if so why is the event firing when it should not ?
Help - Security Event Log Posts Error Event ID 560 Every Few Seconds
May 31, 2007Server 2003 SE SP1 5.2.3790 Sql Server 2000, SP 4, 8.00.2187 (latest hotfix rollup)
We fixed one issue, but it brought up another. the fix we applied stopped the ServicesActive access failure, but now we have a failure on MSSEARCH. The users this is affecting do NOT have admin rights on the machine, they are SQL developers.
We were having
Event Type: Failure Audit
Event Source: Security
Event Category: Object AccessEvent ID: 560
Date: 5/23/2007
Time: 6:27:15 AM
User: domainuser
Computer: MACHINENAME
Description:
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,1623975729}
Process ID: 840
Image File Name: C:WINDOWSsystem32services.exe
Primary User Name: MACHINE$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: User
Client Domain: Domain
Client Logon ID: (0x0,0x6097C608)
Accesses: READ_CONTROL
Connect to service controller
Enumerate services
Query service database lock state
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20015
Applied the following fix
http://support.microsoft.com/kb/907460/
Now we are getting
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007
Time: 10:51:23 AM
User: domainuser
Computer: MACHINE
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: MSSEARCH
Handle ID: -
Operation ID: {0,1627659603}
Process ID: 840
Image File Name: C:WINDOWSsystem32services.exe
Primary User Name: MACHINE$
Primary Domain: domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: user
Client Domain: domain
Client Logon ID: (0x0,0x60D37C1A)
Accesses: READ_CONTROL
Query service configuration information
Query status of service
Enumerate dependencies of service
Query information from service
Privileges: - Restricted Sid Count: 0 Access Mask: 0x2008D