How to Read Log File in SQL Server using TSQL

Problem

One of the issues I have is that the SQL Server Error Log is quite large and it is not always easy to view the contents with the Log File Viewer. This article “Simple way to find errors in SQL Server error log” discussed a method to easily search the error log. Are there any other ways to search and find errors in the error log files?

Solution

SQL Server offers an undocumented system stored procedure sp_readerrorlog. This SP allows you to read the contents of the SQL Server error log files directly from a query window and also allows you to search for certain keywords when reading the error file.

SQL Server sp_readerrorlog

This is a sample of the stored procedure that already exists in the master database. You will see that when this gets called it calls an extended stored procedure xp_readerrorlog.

CREATE PROC [sys].[sp_readerrorlog]( 
   @p1 INT = 0, 
   @p2 INT = NULL, 
   @p3 VARCHAR(255) = NULL, 
   @p4 VARCHAR(255) = NULL) 
AS 
BEGIN 
   IF (NOT IS_SRVROLEMEMBER(N'securityadmin') = 1) 
   BEGIN 
      RAISERROR(15003,-1,-1, N'securityadmin') 
      RETURN (1) 
   END 
    
   IF (@p2 IS NULL) 
       EXEC sys.xp_readerrorlog @p1 
   ELSE 
       EXEC sys.xp_readerrorlog @p1,@p2,@p3,@p4 
END 

This procedure takes four parameters:

  1. Value of error log file you want to read: 0 = current, 1 = Archive #1, 2 = Archive #2, etc…
  2. Log file type: 1 or NULL = error log, 2 = SQL Agent log
  3. Search string 1: String one you want to search for
  4. Search string 2: String two you want to search for to further refine the results

If you do not pass any parameters this will return the contents of the current error log.

Example 1 – Read Archive 6

EXEC sp_readerrorlog 6 

This statement returns all of the rows from the 6th archived error log.

error log output
sp rea2

Example 2 – Find Specific Text

EXEC sp_readerrorlog 6, 1, '2005' 

This returns only the rows from the log where the value 2005 appears.

error log output

Example 3 – Find Two Different Sets of Text

EXEC sp_readerrorlog 6, 1, '2005', 'exec' 

This returns only rows where the value ‘2005’ and ‘exec’ exist.

error log output

xp_readerrrorlog

Even though sp_readerrolog accepts only 4 parameters, the extended stored procedure accepts at least 7 parameters.

If this extended stored procedure is called directly the parameters are as follows:

  1. Value of error log file you want to read: 0 = current, 1 = Archive #1, 2 = Archive #2, etc…
  2. Log file type: 1 or NULL = error log, 2 = SQL Agent log
  3. Search string 1: String one you want to search for
  4. Search string 2: String two you want to search for to further refine the results
  5. Search from start time
  6. Search to end time
  7. Sort order for results: N’asc’ = ascending, N’desc’ = descending

Here are some examples.

EXEC master.dbo.xp_readerrorlog 0, 1, '2005', 'exec', NULL, NULL, N'desc' 
EXEC master.dbo.xp_readerrorlog 0, 1, '2005', 'exec', NULL, NULL, N'asc' 
error log output

Error When Using xp_readerrrorlog

The above example shows the values in single quotes, but for later versions of SQL Server you may need to use double quotes or you might get this error.

Msg 22004, Level 12, State 1, Line 0
Error executing extended stored procedure: Invalid Parameter Type

Try this instead.

EXEC master.dbo.xp_readerrorlog 0, 1, "backup", "failed", "2017-01-02", "2017-02-02", "desc"
EXEC master.dbo.xp_readerrorlog 0, 1, "2005", "exec", NULL, NULL, "asc"

Or try this, putting N before each parameter.

EXEC master.dbo.xp_readerrorlog 0, 1, N'backup', NULL, N'2017-01-02', N'2017-02-02', N'desc'
EXEC master.dbo.xp_readerrorlog 0, 1, N'backup', N'failed', NULL, NULL, N'asc'

Next Steps

  • As you can see this is a much easier way to read the error logs and to also look for a specific error message without having to use the Log File Viewer.
  • Add this to your monitoring routine where this is run daily to search for errors or issues.
  • Read this related article Simple way to find errors in SQL Server error log

4 Comments

  1. Hi Mehwish,

    check out this article: https://www.mssqltips.com/sqlservertip/3090/how-to-find-user-who-ran-drop-or-delete-statements-on-your-sql-server-objects/

    -Greg

  2. Sir, thanks for sharing Info.

    Sir I want to Know Deleted record from specific Table with specific date period

    How I can get this Result In SQL 2008 R2, SQL 20014, SQL 2016

  3. Hi Greg,

    It’s more flexible if you put everything in a temp table. We had a recovery of one of our biggest databases (> 100 TB) and logs were filled with logon issues due to thousands of connections not being able to connect. This script will show all but logon issues:

    DROP TABLE IF EXISTS #SQLErrorLog; –assuming SQL Server 2016+…otherwise use the typical if object exists drop

    CREATE TABLE #SQLErrorLog
    (
    LogDate DATETIME
    ,ProcessInfoNVARCHAR(12)
    ,LogText NVARCHAR(3999)
    )

    INSERT INTO #SQLErrorLog
    (
    LogDate
    ,ProcessInfo
    ,LogText
    )
    EXEC sp_readerrorlog;

    SELECT * FROM #SQLErrorLog
    where processinfo <>’logon’
    order by logdate desc

    Gregory LiÉnard
    Microsoft Data Engineer
    https://seopageoptimizer.com/ : analyses billions of webpages
    https://keyboost.com/ : analyses trillions of links

    If the statistics are boring, you’ve got the wrong numbers.

Leave a Reply

Your email address will not be published. Required fields are marked *