Foglight SQL Server Error Log OS Collector Raises Duplicate Alarms for Single Events (4380110)

When monitoring SQL Server with Foglight, users may observe multiple alarms for a single logical error event. This typically occurs when SQL Server writes a serious error across multiple lines in the error log. The Foglight OS-level error log collector processes each line as a separate event, resulting in duplicate alarms.

The SQL Server OS collector parses each line of the SQL Server Error Log independently. It does not reliably group multi-line log entries into a single event, so each line (e.g., error code and message) may trigger separate alarms for the same logical issue.

This behavior does not occur with the JDBC collector, which merges multi-line entries correctly and raises only one alarm per event.

Workaround

To avoid duplicate alarms, change the SQL Server Error Log collection method from “OS” or “FALLBACK” to “JDBC” in the Agent Status Properties.

1. Navigate to the SQL Server Agent’s Status Properties.
2. Locate the Error Log Collection Method setting.
3. Change the setting from OS or FALLBACK to JDBC.
4. Save and restart collection if necessary.

This ensures multi-line error events are merged and only a single alarm is raised for each logical event.

Status:
Quest is aware of this issue (FOG-11708). A fix will be provided in a future release of the SQL Server cartridge.