Sometimes you do not see the proper event description of SQL Server events in the application log

  • Article

Sometimes you do not see the proper event description of SQL Server events in the application log.

For Eg:

29/07/2009 12:00:00 MSSQLSERVER Information System Event 17055 <SQL server Instance Name > "The description for Event ID ( 17055 ) in Source ( MSSQLSERVER ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: 18265, Log backed up: Database: Database Name, creation date(time): 2006/07/11(09:38:17), first LSN: 720:282:1, last LSN: 720:282:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'G:\MSSQL\BACKUP\Path\Filename.TRN'}).

The actual event description should be:

Log backed up: Database: Database name, creation date(time): 2006/07/11(09:38:17), first LSN: 720:282:1, last LSN: 720:282:1, number of dump devices: 1, device information: (FILE=1, TYPE=DISK: {'Drive:\MSSQL\BACKUP\Path\FileName.TRN'}).

Some monitoring utilities which monitor for SQL Server usually read the application log for any events related to SQL Server. Such utilities will not get the event properly because of the improper event description.

Cause:

The event description for SQL Server will be wrong (As shown above) if the path of the file sqlevn70.rll is different in the registry.

The following registry path has the file path for sqlevn70.rll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\<<INSTANCE NAME>>

<<INSTANCE NAME>> is to be replaced by the actual instance name

Resolution:

To get the correct description for SQL Server events please do the following.

1) Go to the SQL Server folder of the SQL Instance which is showing a wrong event description in SQL server and go to the following folder path

  ….MSSQL\Binn\Resources\1033\

2) Search for the file named sqlevn70.rll present in the folder

3) Go to “start” and click on “RUN”
4) Type REGEDIT
5) Go to the following path in REGISTRY

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSQLServer]

- This will be the path for the default instance of SQL Server

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MSSQL$INSTANCE_NAME]

- This will be the path for the named instance of SQL Server called INSTANCE_NAME

6) On the right side pane search for EventMessageFile of type REG_SZ.
7) Compare the path in the Value Data text box to the actual path of the file.
8) If the path is different, correct the path of the file in the registry and close event viewer reopen it again.

This applies to SQL Server 2000 all editions, SQL Server 2005 all editions, and SQL Server 2008 all editions.

Jerrin K George

Support Engineer, Microsoft SQL Server

Reviewed By,

Ouseph Devis

Tech Lead – Microsoft SQL Server