MS SQL 監控錯誤日志的告警信息

本文轉載自查看原文 2014-10-28 12:09 3421 監控/ 數據庫技術(MS SQL)/ 告警信息/ sql server 錯誤日志

SQL Server的錯誤消息（Error Message）按照消息的嚴重級別一共划分25個等級，級別越高，表示嚴重性也越高。但是如果你統計sys.messages,你會發現，實際上只有16（SQL SERVER 2008/2012）或17個（SQL SERVER 2005）個級別。猜測應該是一些留作擴展用，一些留作用戶自定義錯誤消息的級別。

sys.messages中有個字段is_event_logged，取值為1時表示出現錯誤時將消息記入事件日志。對於 message_id 中的所有消息語言，此參數都是相同的。所以也就是說有些錯誤信息（Error Message）會寫入事件日志，有些就不會寫入錯誤日志。因此監控錯誤日志時，我們只能監控那些寫入錯誤日志的錯誤信息。一般而言，我們應該監控嚴重級別在16~25之間的錯誤信息，另外嚴重級別14的也應該監控（主要是Error: 18456, Severity: 14）。

監控錯誤日志有很多方式，下面介紹一種非常簡單、有效的監控錯誤日志的方法.我們可以通過sp_add_alert創建一個警報（Alerts），如下所示，我們創建一個名稱為SQL Server Severity Event 14的警報（配置前需要配置郵件、ProfileName，Operators,下面腳本也要根據具體情況調整）。關於創建警報的具體信息，可以參考http://msdn.microsoft.com/zh-cn/library/ms189531.aspx

 
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Severity Event 14') 
           
           EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 14' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 14', 
           
            @message_id=0, 
           
            @severity=14, 
           
            @enabled=1, 
           
            @delay_between_responses=60, 
           
            @include_event_description_in=1, 
           
            @category_name=N'DBA_MONITORING', 
           
            @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 14', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO

如下所示，在UAT服務器，我故意用dw賬號錯誤密碼登錄數據庫，一分鍾后，我立馬回收到一封告警郵件

 
          DATE/TIME: ;        2014/10/28 9:21:42 
           
          DESCRIPTION: ;    Login failed for user 'dw'. Reason: Password did not match that for the login provided. [CLIENT: 192.xxx.xxx.xxx] 
           
          COMMENT: ;        (None) 
           
          JOB ;RUN:              (None)

SQL Server 錯誤日志

Windows事件日志

我們依次建立16-25級別的告警來監控數據庫錯誤日志的錯誤信息。如下所示：

 
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Severity Event 16') 
           
              EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 16' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 16',  
           
                  @message_id=0,  
           
                  @severity=16,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 16', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 17') 
           
          EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 17' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 17',  
           
                  @message_id=0,  
           
                  @severity=17,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 17', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 18') 
           
              EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 18' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 18',  
           
                  @message_id=0,  
           
                  @severity=18,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 18', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 19') 
           
              EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 19' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 19',  
           
                  @message_id=0,  
           
                  @severity=19,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 19', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 20') 
           
                  EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 20' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 20',  
           
                  @message_id=0,  
           
                  @severity=20,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 20', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 21') 
           
              EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 21' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 21',  
           
                  @message_id=0,  
           
                  @severity=21,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 21', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 22') 
           
                  EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 22' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 22',  
           
                  @message_id=0,  
           
                  @severity=22,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 22', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 23') 
           
                  EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 23' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 23',  
           
                  @message_id=0,  
           
                  @severity=23,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 23', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 23') 
           
                  EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 23' 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 23',  
           
                  @message_id=0,  
           
                  @severity=23,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 23', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 24') 
           
                  EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 24' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 24',  
           
                  @message_id=0,  
           
                  @severity=24,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 24', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO 
           
          USE [msdb] 
           
          GO 
           
          IF NOT EXISTS(SELECT 1 FROM msdb.dbo.syscategories WHERE NAME='DBA_MONITORING' AND category_class=2) 
           
          BEGIN 
           
          EXEC msdb.dbo.sp_add_category 
           
              @class=N'ALERT', 
           
              @type=N'NONE', 
           
              @name=N'DBA_MONITORING' ; 
           
          END 
           
          GO 
           
          IF  EXISTS (SELECT name FROM msdb.dbo.sysalerts WHERE name = N'SQL Server Severity Event 25') 
           
                  EXEC msdb.dbo.sp_delete_alert @name=N'SQL Server Severity Event 25' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_alert @name=N'SQL Server Severity Event 25',  
           
                  @message_id=0,  
           
                  @severity=25,  
           
                  @enabled=1,  
           
                  @delay_between_responses=60,  
           
                  @include_event_description_in=1,  
           
                  @category_name=N'DBA_MONITORING',  
           
                  @job_id=N'00000000-0000-0000-0000-000000000000' 
           
          GO 
           
          EXEC msdb.dbo.sp_add_notification @alert_name=N'SQL Server Severity Event 25', @operator_name=N'YourSQLDba_Operator', @notification_method = 1 
           
          GO

執行完上面腳本后，就會建立下面幾個告警。當數據庫的錯誤日志出現這些級別的錯誤信息時，就會收到告警郵件。相當的方便、簡單、高效。

免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。

猜您在找 prometheus matil 日志監控錯誤信息，實現日志報錯監控及告警 MS SQL 監控數據/日志文件增長 MS SQL 日志記錄管理 Zabbix日志監控：Linux異常登錄告警 MS SQL 事務日志管理小結 Shell腳本實戰：日志關鍵字監控+自動告警 ElastAlert監控日志告警Web攻擊行為 sql server錯誤日志 ElastAlert監控日志告警Web攻擊行為---tomcat和nginx日志json格式 SQL Server(MSSQLSERVER) 請求失敗或服務未及時響應，有關詳細信息，請參見事件日志或其他的適用的錯誤日志。