Today, i’m troubleshooting an issue with the cluster where our SharePoint databases are housed. I got an alert from SCOM saying that one of the clustered SQL Server instances had failed. (Thanks SCOM a.k.a. OpsMgr for letting me know!)
Anyways, I wanted to know real quick which instances had actually restarted. Quickest way I knew was to filter the Windows application event log down to EventID 17162. Turns out, SCOM was right. Only one instance reported that it had been restarted.
Now that I know which instances have restarted, I can begin the in-depth research…
Consequently, I’ve found that you can track shutdowns of SQL Server by EventID 17148.