Windows 2008 R2 services not working
EDIT I spawned the Windows events logging service won't start issue to a separate question here
I have a strange problem:
- SQLAGENT won't start
- Windows events logging service won't start
Today I tried to copy a db to test some changes, and discovered that SQL server agent can't start
The error message is:
===================================
Unable to start service SQLSERVERAGENT on server MY_SERVERNAME. (mscorlib)
------------------------------
Program Location:
Server stack trace:
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.Start()
at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Object[]& outArgs)
at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)
Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase)
at System.Runtime.Remoting.Proxies.RemotingProxy.Invoke(Object NotUsed, MessageData& msgData)
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.ServiceActionHandler.EndInvoke(IAsyncResult result)
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.ServiceControlProgress.ActionCompletedHandler(IAsyncResult result)
===================================
Service Request Timeout (ObjectExplorer)
------------------------------
Program Location:
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.CheckServiceActionReturnValueSuccess(UInt32 returnValue)
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.Start()
I searched for help, and it was recommended to check in the Events log. I tried to fire up Windows event viewer and got an error message that the service is not running.
I went to services and tried to start Windows Event Log, but it won't start with the error
Windows could not start windows log service on MY_SERVERNAME. Error 2: the system cannot find the file specified.
also Windows event collector service won't start because of the dependency on Event Log.
I tried the following advice I found on the net here:
- restarted the box.
- re-checked the settings in services menu -they are like in the link.
- checked the identity in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog- OK - gave all Authenticated Users full access to
C:\Windows\System32\winevt\Logs - ran fc /scannow - Windows Resource Protection did not find any integrity violations.
- went to the file
%windir%\logs\cbs\cbs.log- all clean, [SR] Repairing 0 components
Also, before it, in the middle of the day, one website went down because it had locking issue with some log file of Entity framework interceptor, so I shut the interceptor on this service, because there was no need in it anyhow. Don't know if it's connected though...
What can it be?
EDIT: ERROR LOG FROM c:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\
2014-05-19 17:39:16.20 Server Error: 17156, Severity: 16, State: 1.
2014-05-19 17:39:16.20 Server initeventlog: Could not initiate the EventLog Service for the key 'MSSQLSERVER', last error code is 1722.
2014-05-19 17:39:16.20 Server Microsoft SQL Server 2012 (SP1) - 11.0.3128.0 (X64)
Dec 28 2012 20:23:12
Copyright (c) Microsoft Corporation
Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) (Hypervisor)
2014-05-19 17:39:16.22 Server (c) Microsoft Corporation.
2014-05-19 17:39:16.22 Server All rights reserved.
2014-05-19 17:39:16.22 Server Server process ID is 1300.
2014-05-19 17:39:16.22 Server System Manufacturer: 'VMware, Inc.', System Model: 'VMware Virtual Platform'.
2014-05-19 17:39:16.22 Server Authentication mode is MIXED.
2014-05-19 17:39:16.22 Server Logging SQL Server messages in file 'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG'.
2014-05-19 17:39:16.22 Server The service account is 'NT Service\MSSQLSERVER'. This is an informational message; no user action is required.
2014-05-19 17:39:16.23 Server Registry startup parameters:
-d C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\master.mdf
-e C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG
-l C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\mastlog.ldf
2014-05-19 17:39:16.23 Server Command Line Startup Parameters:
-s "MSSQLSERVER"
2014-05-19 17:39:17.67 Server SQL Server detected 4 sockets with 1 cores per socket and 1 logical processors per socket, 4 total logical processors; using 4 logical processors based on SQL Server licensing. This is an informational message; no user action is required.
2014-05-19 17:39:17.67 Server SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
2014-05-19 17:39:17.67 Server Detected 8191 MB of RAM. This is an informational message; no user action is required.
2014-05-19 17:39:17.67 Server Using conventional memory in the memory manager.
2014-05-19 17:39:19.88 Server This instance of SQL Server last reported using a process ID of 8892 at 19/05/2014 17:37:59 (local) 19/05/2014 14:37:59 (UTC). This is an informational message only; no user action is required.
2014-05-19 17:39:19.89 Server Node configuration: node 0: CPU mask: 0x000000000000000f:0 Active CPU mask: 0x000000000000000f:0. This message provides a description of the NUMA configuration for this computer. This is an informational message only. No user action is required.
2014-05-19 17:39:19.90 Server Using dynamic lock allocation. Initial allocation of 2500 Lock blocks and 5000 Lock Owner blocks per node. This is an informational message only. No user action is required.
2014-05-19 17:39:19.93 Server Software Usage Metrics is disabled.
2014-05-19 17:39:19.95 spid2s Starting up database 'master'.
2014-05-19 17:39:20.45 Server CLR version v4.0.30319 loaded.
2014-05-19 17:39:21.15 Server Common language runtime (CLR) functionality initialized using CLR version v4.0.30319 from C:\Windows\Microsoft.NET\Framework64\v4.0.30319\.
2014-05-19 17:39:21.19 spid2s Resource governor reconfiguration succeeded.
2014-05-19 17:39:21.19 spid2s SQL Server Audit is starting the audits. This is an informational message. No user action is required.
2014-05-19 17:39:21.20 spid2s SQL Server Audit has started the audits. This is an informational message. No user action is required.
2014-05-19 17:39:21.53 spid2s SQL Trace ID 1 was started by login "***".
2014-05-19 17:39:21.60 spid2s Server name is '****'. This is an informational message only. No user action is required.
2014-05-19 17:39:22.38 spid13s A self-generated certificate was successfully loaded for encryption.
2014-05-19 17:39:22.40 spid13s Server is listening on [ 'any' <ipv6> 1433].
2014-05-19 17:39:22.40 spid13s Server is listening on [ 'any' <ipv4> 1433].
2014-05-19 17:39:22.40 spid13s Server local connection provider is ready to accept connection on [ \\.\pipe\SQLLocal\MSSQLSERVER ].
2014-05-19 17:39:22.40 spid13s Server local connection provider is ready to accept connection on [ \\.\pipe\sql\query ].
2014-05-19 17:39:22.40 Server Server is listening on [ ::1 <ipv6> 1434].
2014-05-19 17:39:22.40 Server Server is listening on [ 127.0.0.1 <ipv4> 1434].
2014-05-19 17:39:22.40 Server Dedicated admin connection support was established for listening locally on port 1434.
2014-05-19 17:39:22.40 Server SQL Server is attempting to register a Service Principal Name (SPN) for the SQL Server service. Kerberos authentication will not be possible until a SPN is registered for the SQL Server service. This is an informational message. No user action is required.
2014-05-19 17:39:22.40 spid13s SQL Server is now ready for client connections. This is an informational message; no user action is required.
2014-05-19 17:39:22.40 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ *** ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2014-05-19 17:39:22.40 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ ***:1433 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2014-05-19 17:39:38.74 Logon Error: 18456, Severity: 14, State: 38.
2014-05-19 17:39:38.74 Logon Login failed for user 'NT SERVICE\ReportServer'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: <local machine>]
2014-05-19 17:39:43.88 Logon Error: 18456, Severity: 14, State: 38.
2014-05-19 17:39:43.88 Logon Login failed for user 'NT SERVICE\ReportServer'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: <local machine>]
2014-05-19 17:39:45.52 spid15s A new instance of the full-text filter daemon host process has been successfully started.
2014-05-19 17:39:45.66 spid15s Starting up database 'msdb'.
2014-05-19 17:39:45.66 spid19s Starting up database 'ReportServerTempDB'.
2014-05-19 17:39:45.66 spid20s Starting up database 'Demo.ConotosoUniversityDb'.
2014-05-19 17:39:45.66 spid9s Starting up database 'mssqlsystemresource'.
2014-05-19 17:39:45.66 spid17s Starting up database 'ReportServer'.
2014-05-19 17:39:45.66 spid21s Starting up database 'AspDotNetDB'.
2014-05-19 17:39:45.66 spid22s Starting up database '***'.
2014-05-19 17:39:45.67 spid23s Starting up database '***'.
2014-05-19 17:39:45.67 spid24s Starting up database 'Demo.ProDinnerDB'.
2014-05-19 17:39:45.68 spid9s The resource database build version is 11.00.3000. This is an informational message only. No user action is required.
2014-05-19 17:39:45.77 spid9s Starting up database 'model'.
2014-05-19 17:39:45.89 spid9s Clearing tempdb database.
2014-05-19 17:39:46.08 spid23s 219 transactions rolled forward in database 'WerbuyWeb.MobileServicesDB.Log' (16:0). This is an informational message only. No user action is required.
2014-05-19 17:39:46.34 spid9s Starting up database 'tempdb'.
2014-05-19 17:39:46.46 spid2s 0 transactions rolled back in database '***' (16:0). This is an informational message only. No user action is required.
2014-05-19 17:39:46.46 spid2s Recovery is writing a checkpoint in database 'WerbuyWeb.MobileServicesDB.Log' (16). This is an informational message only. No user action is required.
2014-05-19 17:39:46.53 spid25s The Service Broker endpoint is in disabled or stopped state.
2014-05-19 17:39:46.54 spid25s The Database Mirroring endpoint is in disabled or stopped state.
2014-05-19 17:39:46.88 spid25s Service Broker manager has started.
2014-05-19 17:39:46.96 spid2s Recovery is complete. This is an informational message only. No user action is required.
2014-05-19 17:42:25.55 spid63 Attempting to load library 'xpsqlbot.dll' into memory. This is an informational message only. No user action is required.
2014-05-19 17:42:25.58 spid63 Using 'xpsqlbot.dll' version '2011.110.2100' to execute extended stored procedure 'xp_qv'. This is an informational message only; no user action is required.
2014-05-19 17:42:26.69 spid64 Attempting to load library 'xpstar.dll' into memory. This is an informational message only. No user action is required.
2014-05-19 17:42:26.76 spid64 Using 'xpstar.dll' version '2011.110.3000' to execute extended stored procedure 'xp_instance_regread'. This is an informational message only; no user action is required.
EDIT SQL agent logs (a bit old)
Date,Source,Severity,Message
05/04/2014 03:16:29,,Warning,[098] SQLServerAgent terminated (forcefully)
05/04/2014 03:16:29,,Error,[359] The local host server is not running
05/04/2014 03:16:29,,Error,[311] Thread 'JobInvocationEngine' (ID 7792) is still running
05/04/2014 03:16:29,,Error,[240] 1 engine thread(s) failed to stop after 2 seconds of waiting
05/04/2014 03:16:29,,Error,[359] The local host server is not running
05/04/2014 03:16:27,,Information,[130] SQLSERVERAGENT stopping because of Windows shutdown...
04/27/2014 10:26:28,,Warning,[396] An idle CPU condition has not been defined - OnIdle job schedules will have no effect
04/27/2014 10:26:28,,Warning,[475] Database Mail is not enabled for agent notifications.
04/27/2014 10:26:28,,Information,[129] SQLSERVERAGENT starting under Windows NT service control
04/27/2014 10:26:28,,Error,[364] The Messenger service has not been started - NetSend notifications will not be sent
04/27/2014 10:26:17,,Information,[432] There are 12 subsystems in the subsystems cache
04/27/2014 10:26:16,,Information,[339] Local computer is *** running Windows NT 6.1 (7601) Service Pack 1
04/27/2014 10:26:16,,Information,[310] 4 processor(s) and 8192 MB RAM detected
04/27/2014 10:26:16,,Information,[103] NetLib being used by driver is DBNETLIB; Local host server is
04/27/2014 10:26:16,,Information,[102] SQL Server ODBC driver version 11.00.3000
04/27/2014 10:26:16,,Information,[101] SQL Server *** version 11.00.3128 (0 connection limit)
04/27/2014 10:26:16,,Information,[000] Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457) Configuration option 'Agent XPs' changed from 0 to 1. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457) Configuration option 'show advanced options' changed from 1 to 0. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457)
04/27/2014 10:26:16,,Information,[393] Waiting for SQL Server to recover database 'msdb'...
04/27/2014 10:26:15,,Information,[495] The SQL Server Agent startup service account is NT Service\SQLSERVERAGENT.
04/27/2014 10:26:15,,Information,[100] Microsoft SQLServerAgent version 11.0.3128.0 (X64 unicode retail build) : Process ID 5668
EDIT: Uninstalled the recent system updates and rebooted - didn't help
The service definition for the event service should be in the registry defined something like the image bellow. The only two files that could be missing would be svchost.exe or wevtsvc.dll so check for those. I would worry about getting this working first.
If these files are both there one option is to use Sysinternals Process Monitor to try and see what files it is trying to open but failing. Run it using Run as administrator and add a filter for Process Name is svchost.exe.