MSSQL 2014: Alert engine stopped due to unrecoverable local eventlog errors

Microsoft.SQLServer.2014.Alert_engine_stopped_due_to_unrecoverable_local_eventlog_errors_1_5_Rule (Rule)

SQL Server Agent was unable to open the local event log.

Knowledge Base article:

Summary

SQL Server Agent was unable to open the local event log.

Resolutions

Upgrade to the latest service pack. If the error persists, contact Microsoft Customer Service and Support.

Overrideable Parameters

Name	Description	Default Value
Enabled		Yes
Generates Alerts		Yes
Priority		1
Severity		1

Element properties:

Target

Microsoft.SQLServer.2014.Agent

Category

EventCollection

Enabled

True

Event_ID

317

Event Source

$Target/Property[Type="SQL2014Core!Microsoft.SQLServer.2014.Agent"]/ServiceName$

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

MSSQL 2014: Alert engine stopped due to unrecoverable local eventlog errors

{0}

Event Log

Application

Comment

Mom2014ID='{6BD14B57-4044-4B5B-9580-566FB5616AF6}';MOM2014GroupID={467ECC75-C5DA-42BD-955C-A73BBB51AF74}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SQLServer.2014.Alert_engine_stopped_due_to_unrecoverable_local_eventlog_errors_1_5_Rule" Target="SQL2014Core!Microsoft.SQLServer.2014.Agent" Enabled="true" ConfirmDelivery="true" Remotable="true" Comment="Mom2014ID='{6BD14B57-4044-4B5B-9580-566FB5616AF6}';MOM2014GroupID={467ECC75-C5DA-42BD-955C-A73BBB51AF74}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>Channel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Application</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>317</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>$Target/Property[Type="SQL2014Core!Microsoft.SQLServer.2014.Agent"]/ServiceName$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SQLServer.2014.Alert_engine_stopped_due_to_unrecoverable_local_eventlog_errors_1_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>