FIX: Alert Engine reads complete Application event log and sends alerts on old events after Windows is restarted

Applies to: SQL Server 2016 Enterprise CoreSQL Server 2016 EnterpriseSQL Server 2016 Developer


After you restart the system, you receive lots of email messages for old SQL Server alerts. The alerts date back to the oldest messages in the Application event log.

Additionally, the following messages are logged:

In the SQLAgent.out file

In the Windows System event log file


The Application event log was configured to have a large maximum log size, either through a Group Policy Object (GPO) setting or a Local setting. When you examine the SQL Server Agent log, you see that at some time shortly after a restart, the handle to the event log is lost. When the handle is lost, the Alert Engine "loses its place" in the event log and sends emails for ALL errors (for which there are alerts defined) in the Application event log after the new event log handle is obtained.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.


Learn about the terminology Microsoft uses to describe software updates.