Return
-
Title
Large number on Event ID 8354 events in the Microsoft SQL Server Application log after enabling Change Auditor for SQL auditing -
Description
Large number on Event ID 8354 events in the Microsoft SQL Server Application log after enabling Change Auditor for SQL auditing. The error is similar to the following:
Log Name: ApplicationSource: MSSQLSERVERDate: 11/23/2016 8:28:32 AMEvent ID: 8354Level: ErrorComputer: SQLServer.test.comDescription:Event Tracing for Windows failed to send an event. Send failures with the same error code may not be reported in the future. Error ID: 0, Event class ID: 96, Cause: (null).The "Event class ID" can vary in the error message. -
Cause
A high volume event has been added to the Change Auditor for SQL Auditing template and it is overwhelming the SQL Server. -
Resolution
Identify the event and remove it from the Change Auditor for SQL Auditing template.
- Find the "Event number" in the following webpage that matches the "Event class ID" referenced in the error. For example, "Event class ID: 96" is "Show plan text":
https://msdn.microsoft.com/en-us/library/ms186265.aspx
- Remove the event from the Change Auditor for SQL Auditing template
If above solution does not resolve your issue, please follow below solution:
Try to increase the Change Auditor agent ETW trace session buffers and alleviate the trace messages in the error logs:
Create / Change below 2 registry keys:HKLM\Software\Quest\ChangeAuditor\AgentDWord32bitName: SQLBufferSizeValue: 128 (decimal)Default is 64HKLM\Software\Quest\ChangeAuditor\AgentDWord32bitName: SQLMaxBuffersValue: 1000 (decimal)Default is 100