When managing SQL Server there are so many different
places to look for system messages. These include the error logs, system event logs,
profiler data, performance counter data, etc. Once you have collected the data
you then need to parse through and interpret the data you collected. One of
these areas where errors and other informational data is stored is the SQL Server
The problem with the SQL Server error log file is that there is so much data
collected it is sometimes hard to determine where the real errors lie. By
default all backups and integrity checks are logged in the error log. In
addition, if you are auditing logins these messages are also stored in the error
log, so this further compounds the problem. In this tip we look at a
simple script that can quickly parse out errors and related error messages.
With SQL Server 2005 and later Microsoft has made this a bit easier to set
filters when looking at the SQL Server error log, but this is still pretty cumbersome and does not really provide you all
of the data you need. The best approach as with many things is to build
your own data parser to find exactly what you need.
Here is a simple view of the Error Log as it normally displays:
Here is a simple view of the Error Log after the errors have been parsed
As you can see this new version is much easier to read and also only shows you
the errors instead of all that additional informational data that is stored in the
error logs. In addition, it shows you all of the error lines at the particular
time the error occurred for the same source, so you do not need to go back to the error log to get the
additional error lines.
Quickly Find and Parse SQL Server Error Log script
This tip was first written in 2007 and after reviewing the tip, it
still works with the latest version of SQL Server.
Here is the script.
The only thing you need to change is the error log number you want to pass to
sp_readerrorlog (see the comment in the code). This will produce the
output as shown in the above image.
DROP TABLE IF EXISTS #errorLog; -- this is new syntax in SQL 2016 and later
CREATE TABLE #errorLog (LogDate DATETIME, ProcessInfo VARCHAR(64), [Text] VARCHAR(MAX));
INSERT INTO #errorLog
EXEC sp_readerrorlog 6 -- specify the log number or use nothing for active error log
FROM #errorLog a
WHERE EXISTS (SELECT *
FROM #errorLog b
WHERE [Text] like 'Error:%'
AND a.LogDate = b.LogDate
AND a.ProcessInfo = b.ProcessInfo)
To figure out the error log number to use, you can look at the error logs in
SSMS as shown below. The current log does not have a number,
but each of
the archives has a number associated with the archive, so for the above code
either use one of these numbers to read that log or use no number to read the
current error log.
Also, if you use an error log number that does not exist, you will get an
Greg Robidoux is the President and founder of Edgewood Solutions, a technology services company delivering services and solutions for Microsoft SQL Server. He is also one of the co-founders of MSSQLTips.com. Greg has been working with SQL Server since 1999, has authored numerous database-related articles, and delivered several presentations related to SQL Server. Before SQL Server, he worked on many data platforms such as DB2, Oracle, Sybase, and Informix.
Hi Greg, I had overlooked that your code will indeed pull out the lines associated with an error; that's nice!
However, I also want to be notified about certain situations which do not report as an 'Error', such as this one: "SQL Server has encountered x occurrence(s) of I/O requests taking longer than 15 seconds to complete on file xx"
Wednesday, February 3, 2021 - 9:39:37 AM - Greg Robidoux
Thanks for sharing your approach as well. There are several ways this can be done.
The code in this tip will pull out all of the lines associated with the error based on the timestamp. It looks like when the error is written all of the rows have the same timestamp, so this will pull the row with the error and any associated rows.
Hi Greg, Thank you for sharing this solution to monitoring SQL Errorlog files!
I am doing something similar, but reversing the approach: not looking for the string 'error', but comparing the entries in the errorlog holding table with a table of items I want to discard (not be warned about). I maintain a table with entries which I want 'skip' (an 'exclusion table'). After collection, I remove entries with such strings from the holding table. In that way I end up with a holding table containing only lines that might require follow-up, which may or may not contain the string 'error'. I do this, because there might be interesting information in lines that relate to an error, but do not contain the string 'error', such as this (on 2 lines): Error: 1105, Severity: 17, State: 2. Could not allocate space for object 'dbo.SORT temporary run storage: 140754765283328' in database 'tempdb' because ....... If the second line is missing, I still have to go to the errorlog to see the relevant details.
I have set it up in PowerShell, so I can easily run it to monitor any number of machines, with a configurable interval, and use a central holding table. For the sake of efficiency, I also use a ProgressMonitor table, to only collect errorlog lines from any instance that were created after the last time that instance was checked.
Thursday, January 7, 2021 - 10:59:24 PM - Eitan Blumin
And an even easier way than fighting with LogParser syntax is to use the undocumented proc xp_readerrorlog, like this example:
xp_readerrorlog 0, 2, 'could not obtain information about Windows NT group/user', null
...where parameters to the proc are as follows:
Parameter 1 (int), is the number of the log file you want to read, default is "0" for current log. The extended stored procedure xp_enumerrorlogs will come in handy in determining what SQL server error logs or SQL server Agent logs exist and when they were created. NOTE: extended stored procedure xp_enumerrorlogs parameter (1) works just like xp_ReadErrorLog parameter (2). A value of 1 shows available SQL error logs and a value of 2 shows Agent logs. The default value is 0.
Parameter 2 (int), value of 1 reads SQL error logs, value of 2 reads SQL Server Agent logs, with a default value of 1.
Parameter 3 varchar (255), is a search string for the log entry, with a default value of NULL.
Parameter 4 varchar (255), is another search string for the log entry, with a default value of NULL.