This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SQL Severity > 19 Error Log Alerting

I'm looking for some confirmation on how I've gone about trying to give my DBAs some alerts from the SQL Error Log but, I'm not 100% true this covers it all. I found this website at Microsoft that shows Error Codes and Severity titled "Database Engine Errors". I did a little bit of spot checking to see if I could find some of these ID in the Windows Event Viewer. The only one I could really simulate effectively was a failed login which did appear in both the Windows Event viewer and in the SQL Error Log as viewed by logging into that Db with MSSMS. Rightly or wrongly, I reasoned that it was possible/likely that the other IDs would also show up there. With that assumption I created two templates both using the Windows Event Log Monitor component. The first SQL Event Monitoring Severity 17-18 with IDs 1101,1105,1214,1453,1454,1458,3627,3967,3999,5904,8628,8645,9002,18058,26040,26042,26044,26046,26050,14151 and the other MSSQLSERVER Severity 19-25 Event IDs with many more IDs. With these I produce a SEV 3 alert for 17-18 and SEV 2 for >19

Sev17-18.JPG

Form what I can tell this works..mostly...I think...LOL. I mean I get the emails showing me the number of occurrences in the polling time frame of a particular ID but, I can't be sure that all of these IDs and/or, more worrisome all of the Severity >17 SQL Error Log events, are accessible and therefore alertable. Anyway I thought I'd throw this out here to benefit others and perhaps get some feedback on it's validity. I've looked at SQL End User Experience components as well but, that seems like a pretty heavy approach; trying to hit a Db that may already be struggling. What else is everyone doing to try to get the data needed to produce these very important alerts?