1

In the Windows Event Viewer application, I see a record that the maximum memory value of SQL Server is reduced by 99%. After this process, we could not access the database from anywhere.

How can we find concrete evidence of the reason for this data change? Did a person do it, was it a cyberattack, was it an automatic timer, etc...

Event viewer screen shot image;

enter image description here

SQL Server Managment Studio Configuration Log screen shot image;

enter image description here

Improve this question
2
  • Did a person do it yes. A person did it. They opened SSMS, entered the new value, and clicked ok. Commented Mar 25, 2024 at 10:59
  • To be precise: they opened SSMS, enabled advanced mode view, entered new values for max and min, clicked OK, then disabled advanced view. Commented Mar 25, 2024 at 14:49

1 Answer 1

Reset to default
1

The SQL Server Error Log should provide who did it. Examine the current and the previous log and search for event 2342.

message: Date 3/25/2014 Log Windows NT (Application) Source MSSQLSERVER Category (2) Event 2342 User [who_did_it] Computer [the_host] Message Configuration option 'min server memory (MB)' changed from 2048 to 512. Run the RECONFIGURE statement to install.

In addition, examine the Details section of the Event ID 15457 (Windows Event Log), there sometimes you may find a Windows user/login named that made the memory adjustment.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.