SQL SERVER – Error: 566, Severity: 21 – An Error Occurred While Writing an Audit Trace. SQL Server is Shutting Down

Have you ever been in a situation where SQL Server shuts down by itself? It sounds strange but I met across a gentleman in flight who reported this issue to me. Since I was curious to know the cause, we exchanged our business cards. Once I came back home, I sent him an email asking more details about the SQL shutdown issue. Let us learn about how to fix error, An Error Occurred While Writing an Audit Trace.

I asked him to share ERRORLOG from the SQL Server instance and I could find below information just before the shutdown.

spid397 Error: 566, Severity: 21, State: 1.

An error occurred while writing an audit trace. SQL Server is shutting down. 
Check and correct error conditions such as insufficient disk space, and then restart SQL Server. 
If the problem persists, disable auditing by starting the server at the command prompt with the “-f” switch, and using SP_CONFIGURE.

The error is kind of self-explanatory. SQL was shut down because it was not able to write to trace file, but the real question is why?

One of the possible way this error would come up would be if we were doing C2 type auditing.

But in that case we can see that it’s set to zero. Then I have asked for more details about various traces which were running and he provided me below script.

exec @rc = sp_trace_create @TraceID output, 6, N’IndiaFileServerT$MSSQL_TraceProdServersFooBar_Trace’, @maxfilesize, NULL

As per books online, the 6 above is a combination of options 2 & 4.  Option 2 makes file rollover after they reach @maxfilesize.  Option 4 specifies that if SQL ever can’t write to the trace file, it will shut down the SQL Server.  This is by design for a security auditing feature.

To find if shutdown option is enabled or not, we can look at running traces using catalog view called as sys.traces.

Since we know that trace is configured to shutdown SQL server in case of failure to write. He agreed to change option to use 2 instead of 6.

At the end, I was happy that we could find cause and solve a mystery.

Reference: Pinal Dave (https://blog.sqlauthority.com)

First appeared on SQL SERVER – Error: 566, Severity: 21 – An Error Occurred While Writing an Audit Trace. SQL Server is Shutting Down