Lot of Events in EventLog related to The database engine detached a database


On Windows Server 2012, you may see many messages as below logged into the Windows Eventlogs every few seconds. If you are seeing this message on a database server, then you may assume this is related to SQL Server, however this message has nothing to do with the SQL Server or any components installed along with SQL Server.

Event Id 327
svchost (1600) The database engine detached a database (2, C:\Windows\system32\LogFiles\Sum\SystemIdentity.mdb). (Time=0 seconds)
Event Id 326
svchost (1600) The database engine attached a database (2, C:\Windows\system32\LogFiles\Sum\SystemIdentity.mdb). (Time=0 seconds)

These message appear because of the “User Access Logging” service which comes with Windows Server 2012. This is enabled by default on servers running Windows Server 2012. This application aggregates client usage data by role and products on a local server which later can be used by IT administrators to find quantities and instances by server role or software product, by user, by device, by the local server, and by date using Windows Management Instrumentation (WMI) or Windows PowerShell cmdlets.

These messages can be sometime logged too frequently causing the eventlog file to become full or even can cause hang or crash of the server.

If you are not using this application “User Access Logging”, then you may consider disabling this service. Follow the below steps to Stop or Disable “User Access Logging”.

– RDP in to the server with an account that has local administrator privileges.
– From the Server Manager, Point to Tools, and then click on Services.
– Scroll down and select “User Access Logging” Service and then click on Stop this service.
– Right-click the “User Access Logging” service name and choose Properties, in the General tab, change the Startup type to Disabled, and then click OK.

You should not see any more of these errors. You may save the old Application and System Eventlogs and clear the eventlogs.

If you are using this service, then you may have to troubleshoot the same. One of the article for troubleshooting steps can be found from http://support2.microsoft.com/kb/2900773/ja
This is in Japanese language, but you can translate this easily to your language.

This is applicable on below versions of Windows Server
Windows Server 2012

Hope this was helpful.

SQLServerF1 Team
In-Depth Blogs on SQL Server, Information about SQL Server Conferences and Events, SQL Server Frequently asked questions, SQL Server Trainings.