EDIT I spawned the Windows events logging service won't start issue to a separate question here

I have a strange problem:

  1. SQLAGENT won't start
  2. Windows events logging service won't start

Today I tried to copy a db to test some changes, and discovered that SQL server agent can't start

The error message is:

    ===================================

Unable to start service SQLSERVERAGENT on server MY_SERVERNAME. (mscorlib)

------------------------------
Program Location:


Server stack trace: 
   at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.Start()
   at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Object[]& outArgs)
   at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)

Exception rethrown at [0]: 
   at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase)
   at System.Runtime.Remoting.Proxies.RemotingProxy.Invoke(Object NotUsed, MessageData& msgData)
   at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.ServiceActionHandler.EndInvoke(IAsyncResult result)
   at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.ServiceControlProgress.ActionCompletedHandler(IAsyncResult result)

===================================

Service Request Timeout (ObjectExplorer)

------------------------------
Program Location:

   at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.CheckServiceActionReturnValueSuccess(UInt32 returnValue)
   at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.Start()

I searched for help, and it was recommended to check in the Events log. I tried to fire up Windows event viewer and got an error message that the service is not running.

I went to services and tried to start Windows Event Log, but it won't start with the error

Windows could not start windows log service on MY_SERVERNAME. Error 2: the system cannot find the file specified.

also Windows event collector service won't start because of the dependency on Event Log.

I tried the following advice I found on the net here:

  1. restarted the box.
  2. re-checked the settings in services menu -they are like in the link.
  3. checked the identity in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog - OK
  4. gave all Authenticated Users full access to C:\Windows\System32\winevt\Logs
  5. ran fc /scannow - Windows Resource Protection did not find any integrity violations.
  6. went to the file %windir%\logs\cbs\cbs.log - all clean, [SR] Repairing 0 components

Also, before it, in the middle of the day, one website went down because it had locking issue with some log file of Entity framework interceptor, so I shut the interceptor on this service, because there was no need in it anyhow. Don't know if it's connected though...

What can it be?

EDIT: ERROR LOG FROM c:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\

2014-05-19 17:39:16.20 Server      Error: 17156, Severity: 16, State: 1.
2014-05-19 17:39:16.20 Server      initeventlog: Could not initiate the EventLog Service for the key 'MSSQLSERVER', last error code is 1722.
2014-05-19 17:39:16.20 Server      Microsoft SQL Server 2012 (SP1) - 11.0.3128.0 (X64) 
    Dec 28 2012 20:23:12 
    Copyright (c) Microsoft Corporation
    Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) (Hypervisor)

2014-05-19 17:39:16.22 Server      (c) Microsoft Corporation.
2014-05-19 17:39:16.22 Server      All rights reserved.
2014-05-19 17:39:16.22 Server      Server process ID is 1300.
2014-05-19 17:39:16.22 Server      System Manufacturer: 'VMware, Inc.', System Model: 'VMware Virtual Platform'.
2014-05-19 17:39:16.22 Server      Authentication mode is MIXED.
2014-05-19 17:39:16.22 Server      Logging SQL Server messages in file 'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG'.
2014-05-19 17:39:16.22 Server      The service account is 'NT Service\MSSQLSERVER'. This is an informational message; no user action is required.
2014-05-19 17:39:16.23 Server      Registry startup parameters: 
     -d C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\master.mdf
     -e C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG
     -l C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\mastlog.ldf
2014-05-19 17:39:16.23 Server      Command Line Startup Parameters:
     -s "MSSQLSERVER"
2014-05-19 17:39:17.67 Server      SQL Server detected 4 sockets with 1 cores per socket and 1 logical processors per socket, 4 total logical processors; using 4 logical processors based on SQL Server licensing. This is an informational message; no user action is required.
2014-05-19 17:39:17.67 Server      SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
2014-05-19 17:39:17.67 Server      Detected 8191 MB of RAM. This is an informational message; no user action is required.
2014-05-19 17:39:17.67 Server      Using conventional memory in the memory manager.
2014-05-19 17:39:19.88 Server      This instance of SQL Server last reported using a process ID of 8892 at 19/05/2014 17:37:59 (local) 19/05/2014 14:37:59 (UTC). This is an informational message only; no user action is required.
2014-05-19 17:39:19.89 Server      Node configuration: node 0: CPU mask: 0x000000000000000f:0 Active CPU mask: 0x000000000000000f:0. This message provides a description of the NUMA configuration for this computer. This is an informational message only. No user action is required.
2014-05-19 17:39:19.90 Server      Using dynamic lock allocation.  Initial allocation of 2500 Lock blocks and 5000 Lock Owner blocks per node.  This is an informational message only.  No user action is required.
2014-05-19 17:39:19.93 Server      Software Usage Metrics is disabled.
2014-05-19 17:39:19.95 spid2s      Starting up database 'master'.
2014-05-19 17:39:20.45 Server      CLR version v4.0.30319 loaded.
2014-05-19 17:39:21.15 Server      Common language runtime (CLR) functionality initialized using CLR version v4.0.30319 from C:\Windows\Microsoft.NET\Framework64\v4.0.30319\.
2014-05-19 17:39:21.19 spid2s      Resource governor reconfiguration succeeded.
2014-05-19 17:39:21.19 spid2s      SQL Server Audit is starting the audits. This is an informational message. No user action is required.
2014-05-19 17:39:21.20 spid2s      SQL Server Audit has started the audits. This is an informational message. No user action is required.
2014-05-19 17:39:21.53 spid2s      SQL Trace ID 1 was started by login "***".
2014-05-19 17:39:21.60 spid2s      Server name is '****'. This is an informational message only. No user action is required.
2014-05-19 17:39:22.38 spid13s     A self-generated certificate was successfully loaded for encryption.
2014-05-19 17:39:22.40 spid13s     Server is listening on [ 'any' <ipv6> 1433].
2014-05-19 17:39:22.40 spid13s     Server is listening on [ 'any' <ipv4> 1433].
2014-05-19 17:39:22.40 spid13s     Server local connection provider is ready to accept connection on [ \\.\pipe\SQLLocal\MSSQLSERVER ].
2014-05-19 17:39:22.40 spid13s     Server local connection provider is ready to accept connection on [ \\.\pipe\sql\query ].
2014-05-19 17:39:22.40 Server      Server is listening on [ ::1 <ipv6> 1434].
2014-05-19 17:39:22.40 Server      Server is listening on [ 127.0.0.1 <ipv4> 1434].
2014-05-19 17:39:22.40 Server      Dedicated admin connection support was established for listening locally on port 1434.
2014-05-19 17:39:22.40 Server      SQL Server is attempting to register a Service Principal Name (SPN) for the SQL Server service. Kerberos authentication will not be possible until a SPN is registered for the SQL Server service. This is an informational message. No user action is required.
2014-05-19 17:39:22.40 spid13s     SQL Server is now ready for client connections. This is an informational message; no user action is required.
2014-05-19 17:39:22.40 Server      The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ *** ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2014-05-19 17:39:22.40 Server      The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ ***:1433 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2014-05-19 17:39:38.74 Logon       Error: 18456, Severity: 14, State: 38.
2014-05-19 17:39:38.74 Logon       Login failed for user 'NT SERVICE\ReportServer'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: <local machine>]
2014-05-19 17:39:43.88 Logon       Error: 18456, Severity: 14, State: 38.
2014-05-19 17:39:43.88 Logon       Login failed for user 'NT SERVICE\ReportServer'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: <local machine>]
2014-05-19 17:39:45.52 spid15s     A new instance of the full-text filter daemon host process has been successfully started.
2014-05-19 17:39:45.66 spid15s     Starting up database 'msdb'.
2014-05-19 17:39:45.66 spid19s     Starting up database 'ReportServerTempDB'.
2014-05-19 17:39:45.66 spid20s     Starting up database 'Demo.ConotosoUniversityDb'.
2014-05-19 17:39:45.66 spid9s      Starting up database 'mssqlsystemresource'.
2014-05-19 17:39:45.66 spid17s     Starting up database 'ReportServer'.
2014-05-19 17:39:45.66 spid21s     Starting up database 'AspDotNetDB'.
2014-05-19 17:39:45.66 spid22s     Starting up database '***'.
2014-05-19 17:39:45.67 spid23s     Starting up database '***'.
2014-05-19 17:39:45.67 spid24s     Starting up database 'Demo.ProDinnerDB'.
2014-05-19 17:39:45.68 spid9s      The resource database build version is 11.00.3000. This is an informational message only. No user action is required.
2014-05-19 17:39:45.77 spid9s      Starting up database 'model'.
2014-05-19 17:39:45.89 spid9s      Clearing tempdb database.
2014-05-19 17:39:46.08 spid23s     219 transactions rolled forward in database 'WerbuyWeb.MobileServicesDB.Log' (16:0). This is an informational message only. No user action is required.
2014-05-19 17:39:46.34 spid9s      Starting up database 'tempdb'.
2014-05-19 17:39:46.46 spid2s      0 transactions rolled back in database '***' (16:0). This is an informational message only. No user action is required.
2014-05-19 17:39:46.46 spid2s      Recovery is writing a checkpoint in database 'WerbuyWeb.MobileServicesDB.Log' (16). This is an informational message only. No user action is required.
2014-05-19 17:39:46.53 spid25s     The Service Broker endpoint is in disabled or stopped state.
2014-05-19 17:39:46.54 spid25s     The Database Mirroring endpoint is in disabled or stopped state.
2014-05-19 17:39:46.88 spid25s     Service Broker manager has started.
2014-05-19 17:39:46.96 spid2s      Recovery is complete. This is an informational message only. No user action is required.
2014-05-19 17:42:25.55 spid63      Attempting to load library 'xpsqlbot.dll' into memory. This is an informational message only. No user action is required.
2014-05-19 17:42:25.58 spid63      Using 'xpsqlbot.dll' version '2011.110.2100' to execute extended stored procedure 'xp_qv'. This is an informational message only; no user action is required.
2014-05-19 17:42:26.69 spid64      Attempting to load library 'xpstar.dll' into memory. This is an informational message only. No user action is required.
2014-05-19 17:42:26.76 spid64      Using 'xpstar.dll' version '2011.110.3000' to execute extended stored procedure 'xp_instance_regread'. This is an informational message only; no user action is required.

EDIT SQL agent logs (a bit old)

Date,Source,Severity,Message
05/04/2014 03:16:29,,Warning,[098] SQLServerAgent terminated (forcefully)
05/04/2014 03:16:29,,Error,[359] The local host server is not running
05/04/2014 03:16:29,,Error,[311] Thread 'JobInvocationEngine' (ID 7792) is still running
05/04/2014 03:16:29,,Error,[240] 1 engine thread(s) failed to stop after 2 seconds of waiting
05/04/2014 03:16:29,,Error,[359] The local host server is not running
05/04/2014 03:16:27,,Information,[130] SQLSERVERAGENT stopping because of Windows shutdown...
04/27/2014 10:26:28,,Warning,[396] An idle CPU condition has not been defined - OnIdle job schedules will have no effect
04/27/2014 10:26:28,,Warning,[475] Database Mail is not enabled for agent notifications.
04/27/2014 10:26:28,,Information,[129] SQLSERVERAGENT starting under Windows NT service control
04/27/2014 10:26:28,,Error,[364] The Messenger service has not been started - NetSend notifications will not be sent
04/27/2014 10:26:17,,Information,[432] There are 12 subsystems in the subsystems cache
04/27/2014 10:26:16,,Information,[339] Local computer is *** running Windows NT 6.1 (7601) Service Pack 1
04/27/2014 10:26:16,,Information,[310] 4 processor(s) and 8192 MB RAM detected
04/27/2014 10:26:16,,Information,[103] NetLib being used by driver is DBNETLIB; Local host server is
04/27/2014 10:26:16,,Information,[102] SQL Server ODBC driver version 11.00.3000
04/27/2014 10:26:16,,Information,[101] SQL Server *** version 11.00.3128 (0 connection limit)
04/27/2014 10:26:16,,Information,[000] Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457)  Configuration option 'Agent XPs' changed from 0 to 1. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457)  Configuration option 'show advanced options' changed from 1 to 0. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457)
04/27/2014 10:26:16,,Information,[393] Waiting for SQL Server to recover database 'msdb'...
04/27/2014 10:26:15,,Information,[495] The SQL Server Agent startup service account is NT Service\SQLSERVERAGENT.
04/27/2014 10:26:15,,Information,[100] Microsoft SQLServerAgent version 11.0.3128.0 (X64 unicode retail build) : Process ID 5668

EDIT: Uninstalled the recent system updates and rebooted - didn't help


The service definition for the event service should be in the registry defined something like the image bellow. The only two files that could be missing would be svchost.exe or wevtsvc.dll so check for those. I would worry about getting this working first.

enter image description here

If these files are both there one option is to use Sysinternals Process Monitor to try and see what files it is trying to open but failing. Run it using Run as administrator and add a filter for Process Name is svchost.exe.