Warning/Error Message

[Northwest Upgrades Plus]

I keep getting the following Warning and Error Message on my SBS 2003
Application Event Viewer and have no idea what it means or how to fix it. The
links do not provide any help either. Any help would be greatly appreciated.

Event Type: Warning
Event Source: SQLAgent$SBSMONITORING
Event Category: Alert Engine
Event ID: 312
Date: 6/13/2005
Time: 8:09:41 PM
User: N/A
Computer: MAINSERVER
Description:
Successfully re-opened the local eventlog - NOTE: Some events may have been
missed.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: SQLAgent$SBSMONITORING
Event Category: Alert Engine
Event ID: 318
Date: 6/13/2005
Time: 8:09:41 PM
User: N/A
Computer: MAINSERVER
Description:
Unable to read local eventlog (reason: The event log file has changed
between read operations).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

--
Thanks for your help.

[Dirk-Thomas Brown]

Not to worry, the event logs were simply deleted or overwritten before the
SQL instance could document the changes. Happens to me every time I delete
the event logs...

Dirk-Thomas

"Northwest Upgrades Plus" <an...@nwupgradesplus.com(donotspam)> wrote in
message news:9AD95517-BBF1-4C5D...@microsoft.com...

[Nathan Liu [MSFT]]

Hello Andy,

Thank you for posting in the SBS newsgroup.

Also, many thanks for Dirk-Thomas's great input.

According to your description, I understand that you received the "Warning
312" and "Error 318" messages on the SBS 2003 Server. If I have
misunderstood your concern, please don't hesitate to let me know.

To narrow down this issue, please refer to the following information:

Event ID: 312 NOTE: Some events may have been missed.

This means SQLAgent$SBSMONITORING is unable to read local event log, it can
happen if you clear down the Event log, it also happen if the
readeventlog() call fails because the Buffer it uses to read the Event log
information is not large enough, it then resizes the buffer the next time
it makes the call, with the information provided in the previous failure,
so it is a fairly benign error and can be safely ignored, unless it is
happening constantly.

Event ID: 318 Reason: The Event log file has changed between read
operations.

- When the SQL Server wants to write events to the event log, someone
clears it. To warn the user that some events may have been lost, this event
is logged. It is followed by information Event ID 311 and then by warning
Event ID 312.

Additionally, please refer to the following KB article:

811484 PRB: SQL Server Agent May Report Event ID: 318 Error After an
http://support.microsoft.com/?id=811484

I hope this helps. If you have any questions or concerns, please do not
hesitate to let me know. I am always happy to be of further assistance.

Best regards,

Nathan Liu (MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
>From: "Dirk-Thomas Brown" <youha...@hotmail.com>
>References: <9AD95517-BBF1-4C5D...@microsoft.com>
>Subject: Re: Warning/Error Message
>Date: Tue, 14 Jun 2005 10:15:24 -0700
>Lines: 49
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>X-RFC2646: Format=Flowed; Original
>Message-ID: <uRwBoSQc...@TK2MSFTNGP10.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: adsl-66-123-75-67.dsl.pltn13.pacbell.net 66.123.75.67
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:127262
>X-Tomcat-NG: microsoft.public.windows.server.sbs