Symptoms
After you restart the system, you receive lots of email messages for old SQL Server alerts. The alerts date back to the oldest messages in the Application event log.
Additionally, the following messages are logged:
In the SQLAgent.out file
<DateTime> - ! [LOG] Unable to read local eventlog (reason: The RPC server is unavailable)
<DateTime> - ! [LOG] Unable to read local eventlog (reason: The handle is invalid)
<DateTime> - + [LOG] Successfully re-opened the local eventlog - NOTE: Some events may have been missed
In the Windows System event log file
<DateTime> Information server_name. 7036 Service Control Manager N/A N/A The Windows Event Log service entered the stopped state.
<DateTime> Information server_name. 7036 Service Control Manager N/A N/A The Windows Event Log service entered the running state.
Cause
The Application event log was configured to have a large maximum log size, either through a Group Policy Object (GPO) setting or a Local setting. When you examine the SQL Server Agent log, you see that at some time shortly after a restart, the handle to the event log is lost. When the handle is lost, the Alert Engine "loses its place" in the event log and sends emails for ALL errors (for which there are alerts defined) in the Application event log after the new event log handle is obtained.
Resolution
This fix is included in the following updates:
Each new cumulative update for SQL Server contains all the hotfixes and all the security fixes that were included with the previous cumulative update. Check out the latest cumulative updates for SQL Server:
Latest cumulative update for SQL Server 2017
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
References
Learn about the terminology Microsoft uses to describe software updates.
