编辑我提出了这个Windows events logging service won't start问题针对此处的另一个问题
我有一个奇怪的问题：
- SQLAGENT 无法启动
- Windows 事件日志服务无法启动
今天我尝试复制一个数据库来测试一些更改，发现 SQL Server 代理无法启动
错误信息是：
===================================
Unable to start service SQLSERVERAGENT on server MY_SERVERNAME. (mscorlib)
------------------------------
Program Location:
Server stack trace:
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.Start()
at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Object[]& outArgs)
at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)
Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase)
at System.Runtime.Remoting.Proxies.RemotingProxy.Invoke(Object NotUsed, MessageData& msgData)
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.ServiceActionHandler.EndInvoke(IAsyncResult result)
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.ServiceControlProgress.ActionCompletedHandler(IAsyncResult result)
===================================
Service Request Timeout (ObjectExplorer)
------------------------------
Program Location:
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.CheckServiceActionReturnValueSuccess(UInt32 returnValue)
at Microsoft.SqlServer.Management.UI.VSIntegration.ObjectExplorer.Service.Start()
我搜索了帮助，有人建议检查事件日志。我尝试启动 Windows 事件查看器，但收到一条错误消息，提示服务未运行。
我进入服务并尝试启动 Windows 事件日志，但它无法启动并出现错误
Windows could not start windows log service on MY_SERVERNAME. Error 2: the system cannot find the file specified.
Windows event collector由于依赖事件日志，服务也无法启动。
我尝试了网上找到的以下建议这里：
- 重新启动了盒子。
- 重新检查了服务菜单中的设置 - 它们就像链接中的一样。
- 已核实身份
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog-OK - 授予所有经过身份验证的用户完全访问权限
C:\Windows\System32\winevt\Logs - 运行 fc /scannow-Windows 资源保护未发现任何完整性违规。
- 进入文件
%windir%\logs\cbs\cbs.log- 全部干净，[SR] 修复 0 个组件
另外，在此之前，在一天的中午，一个网站因为 Entity 框架拦截器的一些日志文件锁定问题而瘫痪了，所以我关闭了此服务上的拦截器，因为无论如何它都没有必要。但不知道这是否有关联...
这会是什么呢？
编辑：错误日志来自 c:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\
2014-05-19 17:39:16.20 Server Error: 17156, Severity: 16, State: 1.
2014-05-19 17:39:16.20 Server initeventlog: Could not initiate the EventLog Service for the key 'MSSQLSERVER', last error code is 1722.
2014-05-19 17:39:16.20 Server Microsoft SQL Server 2012 (SP1) - 11.0.3128.0 (X64)
Dec 28 2012 20:23:12
Copyright (c) Microsoft Corporation
Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) (Hypervisor)
2014-05-19 17:39:16.22 Server (c) Microsoft Corporation.
2014-05-19 17:39:16.22 Server All rights reserved.
2014-05-19 17:39:16.22 Server Server process ID is 1300.
2014-05-19 17:39:16.22 Server System Manufacturer: 'VMware, Inc.', System Model: 'VMware Virtual Platform'.
2014-05-19 17:39:16.22 Server Authentication mode is MIXED.
2014-05-19 17:39:16.22 Server Logging SQL Server messages in file 'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG'.
2014-05-19 17:39:16.22 Server The service account is 'NT Service\MSSQLSERVER'. This is an informational message; no user action is required.
2014-05-19 17:39:16.23 Server Registry startup parameters:
-d C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\master.mdf
-e C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log\ERRORLOG
-l C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\mastlog.ldf
2014-05-19 17:39:16.23 Server Command Line Startup Parameters:
-s "MSSQLSERVER"
2014-05-19 17:39:17.67 Server SQL Server detected 4 sockets with 1 cores per socket and 1 logical processors per socket, 4 total logical processors; using 4 logical processors based on SQL Server licensing. This is an informational message; no user action is required.
2014-05-19 17:39:17.67 Server SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
2014-05-19 17:39:17.67 Server Detected 8191 MB of RAM. This is an informational message; no user action is required.
2014-05-19 17:39:17.67 Server Using conventional memory in the memory manager.
2014-05-19 17:39:19.88 Server This instance of SQL Server last reported using a process ID of 8892 at 19/05/2014 17:37:59 (local) 19/05/2014 14:37:59 (UTC). This is an informational message only; no user action is required.
2014-05-19 17:39:19.89 Server Node configuration: node 0: CPU mask: 0x000000000000000f:0 Active CPU mask: 0x000000000000000f:0. This message provides a description of the NUMA configuration for this computer. This is an informational message only. No user action is required.
2014-05-19 17:39:19.90 Server Using dynamic lock allocation. Initial allocation of 2500 Lock blocks and 5000 Lock Owner blocks per node. This is an informational message only. No user action is required.
2014-05-19 17:39:19.93 Server Software Usage Metrics is disabled.
2014-05-19 17:39:19.95 spid2s Starting up database 'master'.
2014-05-19 17:39:20.45 Server CLR version v4.0.30319 loaded.
2014-05-19 17:39:21.15 Server Common language runtime (CLR) functionality initialized using CLR version v4.0.30319 from C:\Windows\Microsoft.NET\Framework64\v4.0.30319\.
2014-05-19 17:39:21.19 spid2s Resource governor reconfiguration succeeded.
2014-05-19 17:39:21.19 spid2s SQL Server Audit is starting the audits. This is an informational message. No user action is required.
2014-05-19 17:39:21.20 spid2s SQL Server Audit has started the audits. This is an informational message. No user action is required.
2014-05-19 17:39:21.53 spid2s SQL Trace ID 1 was started by login "***".
2014-05-19 17:39:21.60 spid2s Server name is '****'. This is an informational message only. No user action is required.
2014-05-19 17:39:22.38 spid13s A self-generated certificate was successfully loaded for encryption.
2014-05-19 17:39:22.40 spid13s Server is listening on [ 'any' <ipv6> 1433].
2014-05-19 17:39:22.40 spid13s Server is listening on [ 'any' <ipv4> 1433].
2014-05-19 17:39:22.40 spid13s Server local connection provider is ready to accept connection on [ \\.\pipe\SQLLocal\MSSQLSERVER ].
2014-05-19 17:39:22.40 spid13s Server local connection provider is ready to accept connection on [ \\.\pipe\sql\query ].
2014-05-19 17:39:22.40 Server Server is listening on [ ::1 <ipv6> 1434].
2014-05-19 17:39:22.40 Server Server is listening on [ 127.0.0.1 <ipv4> 1434].
2014-05-19 17:39:22.40 Server Dedicated admin connection support was established for listening locally on port 1434.
2014-05-19 17:39:22.40 Server SQL Server is attempting to register a Service Principal Name (SPN) for the SQL Server service. Kerberos authentication will not be possible until a SPN is registered for the SQL Server service. This is an informational message. No user action is required.
2014-05-19 17:39:22.40 spid13s SQL Server is now ready for client connections. This is an informational message; no user action is required.
2014-05-19 17:39:22.40 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ *** ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2014-05-19 17:39:22.40 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ ***:1433 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2014-05-19 17:39:38.74 Logon Error: 18456, Severity: 14, State: 38.
2014-05-19 17:39:38.74 Logon Login failed for user 'NT SERVICE\ReportServer'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: <local machine>]
2014-05-19 17:39:43.88 Logon Error: 18456, Severity: 14, State: 38.
2014-05-19 17:39:43.88 Logon Login failed for user 'NT SERVICE\ReportServer'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: <local machine>]
2014-05-19 17:39:45.52 spid15s A new instance of the full-text filter daemon host process has been successfully started.
2014-05-19 17:39:45.66 spid15s Starting up database 'msdb'.
2014-05-19 17:39:45.66 spid19s Starting up database 'ReportServerTempDB'.
2014-05-19 17:39:45.66 spid20s Starting up database 'Demo.ConotosoUniversityDb'.
2014-05-19 17:39:45.66 spid9s Starting up database 'mssqlsystemresource'.
2014-05-19 17:39:45.66 spid17s Starting up database 'ReportServer'.
2014-05-19 17:39:45.66 spid21s Starting up database 'AspDotNetDB'.
2014-05-19 17:39:45.66 spid22s Starting up database '***'.
2014-05-19 17:39:45.67 spid23s Starting up database '***'.
2014-05-19 17:39:45.67 spid24s Starting up database 'Demo.ProDinnerDB'.
2014-05-19 17:39:45.68 spid9s The resource database build version is 11.00.3000. This is an informational message only. No user action is required.
2014-05-19 17:39:45.77 spid9s Starting up database 'model'.
2014-05-19 17:39:45.89 spid9s Clearing tempdb database.
2014-05-19 17:39:46.08 spid23s 219 transactions rolled forward in database 'WerbuyWeb.MobileServicesDB.Log' (16:0). This is an informational message only. No user action is required.
2014-05-19 17:39:46.34 spid9s Starting up database 'tempdb'.
2014-05-19 17:39:46.46 spid2s 0 transactions rolled back in database '***' (16:0). This is an informational message only. No user action is required.
2014-05-19 17:39:46.46 spid2s Recovery is writing a checkpoint in database 'WerbuyWeb.MobileServicesDB.Log' (16). This is an informational message only. No user action is required.
2014-05-19 17:39:46.53 spid25s The Service Broker endpoint is in disabled or stopped state.
2014-05-19 17:39:46.54 spid25s The Database Mirroring endpoint is in disabled or stopped state.
2014-05-19 17:39:46.88 spid25s Service Broker manager has started.
2014-05-19 17:39:46.96 spid2s Recovery is complete. This is an informational message only. No user action is required.
2014-05-19 17:42:25.55 spid63 Attempting to load library 'xpsqlbot.dll' into memory. This is an informational message only. No user action is required.
2014-05-19 17:42:25.58 spid63 Using 'xpsqlbot.dll' version '2011.110.2100' to execute extended stored procedure 'xp_qv'. This is an informational message only; no user action is required.
2014-05-19 17:42:26.69 spid64 Attempting to load library 'xpstar.dll' into memory. This is an informational message only. No user action is required.
2014-05-19 17:42:26.76 spid64 Using 'xpstar.dll' version '2011.110.3000' to execute extended stored procedure 'xp_instance_regread'. This is an informational message only; no user action is required.
编辑SQL 代理日志（有点旧）
Date,Source,Severity,Message
05/04/2014 03:16:29,,Warning,[098] SQLServerAgent terminated (forcefully)
05/04/2014 03:16:29,,Error,[359] The local host server is not running
05/04/2014 03:16:29,,Error,[311] Thread 'JobInvocationEngine' (ID 7792) is still running
05/04/2014 03:16:29,,Error,[240] 1 engine thread(s) failed to stop after 2 seconds of waiting
05/04/2014 03:16:29,,Error,[359] The local host server is not running
05/04/2014 03:16:27,,Information,[130] SQLSERVERAGENT stopping because of Windows shutdown...
04/27/2014 10:26:28,,Warning,[396] An idle CPU condition has not been defined - OnIdle job schedules will have no effect
04/27/2014 10:26:28,,Warning,[475] Database Mail is not enabled for agent notifications.
04/27/2014 10:26:28,,Information,[129] SQLSERVERAGENT starting under Windows NT service control
04/27/2014 10:26:28,,Error,[364] The Messenger service has not been started - NetSend notifications will not be sent
04/27/2014 10:26:17,,Information,[432] There are 12 subsystems in the subsystems cache
04/27/2014 10:26:16,,Information,[339] Local computer is *** running Windows NT 6.1 (7601) Service Pack 1
04/27/2014 10:26:16,,Information,[310] 4 processor(s) and 8192 MB RAM detected
04/27/2014 10:26:16,,Information,[103] NetLib being used by driver is DBNETLIB; Local host server is
04/27/2014 10:26:16,,Information,[102] SQL Server ODBC driver version 11.00.3000
04/27/2014 10:26:16,,Information,[101] SQL Server *** version 11.00.3128 (0 connection limit)
04/27/2014 10:26:16,,Information,[000] Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457) Configuration option 'Agent XPs' changed from 0 to 1. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457) Configuration option 'show advanced options' changed from 1 to 0. Run the RECONFIGURE statement to install. [SQLSTATE 01000] (Message 15457)
04/27/2014 10:26:16,,Information,[393] Waiting for SQL Server to recover database 'msdb'...
04/27/2014 10:26:15,,Information,[495] The SQL Server Agent startup service account is NT Service\SQLSERVERAGENT.
04/27/2014 10:26:15,,Information,[100] Microsoft SQLServerAgent version 11.0.3128.0 (X64 unicode retail build) : Process ID 5668
编辑：卸载了最近的系统更新并重新启动 - 没有帮助
答案1
事件服务的服务定义应该在注册表中定义，如下图所示。可能缺少的唯一两个文件是svchost.exe或wevtsvc.dll检查一下这两个文件。我首先担心的是让它工作。
如果这两个文件都存在，则一个选项是使用 Sysinternals进程监控尝试查看它尝试打开但失败的文件。使用 运行它Run as administrator并添加进程名称为 的过滤器svchost.exe。