Contents Menu Expand Light mode Dark mode Auto light/dark mode
EventReporter 19.1 documentation
EventReporter 19.1 documentation
  • Getting Started
    • Installation
    • System Requirements
    • Understand the Components
    • Collect Windows Events
    • Creating an Initial Configuration
    • Process and Filter
    • Store and Forward
    • Operate and Troubleshoot
  • Tutorials
    • Tutorial: Collect Windows Events and Write Them to a File
    • Tutorial: Forward Windows Events to a Syslog Server
    • Tutorial: Forward Windows Events via TLS to rsyslog
    • Tutorial: Forward Windows Events via SETP
    • Tutorial: Send Matching Windows Events by Email
    • Tutorial: Write Windows Events to a Database
    • Tutorial: Export the Configuration and Create a Debug Log
  • Configuration
    • Configuring EventReporter
    • Client Options
    • Client Tools
    • Using File based configuration
    • General Options
      • License
      • General
      • Debug
      • Engine
      • Queue Manager
    • Core concepts
      • EventReporter services
      • Information Units
      • Rules
      • The Rule Engine
      • EventReporter filter conditions
      • Actions
    • Services
      • Heartbeat
      • MonitorWare Echo Reply
      • Event Log Monitor V1
      • Event Log Monitor V2
    • Filter Conditions
      • Global Conditions
      • Date Conditions
      • Operators
      • Filters
        • REGEX Compare Operation
      • General
      • Date/Time
      • InformationUnit Type
      • Event Log Monitor
      • Event Log Monitor V2
      • Custom Property
      • Extended Number Property
      • Extended IP Property
      • File Exists
      • Store Filter Results
    • Actions
      • ODBC Database Options
      • OLEDB Database Action
      • File Logging Options
      • Event Log Options
      • Send Email
      • Net Send
      • Send SETP
      • Syslog Forwarding
      • Send DTLS
      • Call RuleSet
      • Compute Status Variable
      • Discard
      • Resolve Hostname Action
      • Set Property
      • Set Status
      • Play Sound
      • Start Program
    • Multiple RuleSets - Rules - Actions
  • FAQ
    • Why are Logfiles sometimes not rotated in EventReporter 18.5 to 19.1?
    • Log Rotation Naming Convention Change in EventReporter 19.x
    • Why does log rotation fail when using ZIP compression in EventReporter?
    • Are EventReporter products affected by recent OpenSSL CVEs?
    • Troubleshooting the Start Program action in EventReporter
    • Queue Buildup During SQL Server Table Cleanup Operations in EventReporter
    • Recommended Service Stop Order for EventReporter Maintenance
    • Running EventReporter on a Windows Cluster Server
    • How to Export EventReporter Settings for a Support Call
    • Why do log files remain locked when multiple rules write to the same file?
    • Is MariaDB supported by the ODBC action?
    • How to Perform a Mass Rollout of EventReporter
    • How to Copy the EventReporter Configuration to Other Servers
    • How Can I Obtain a Printable Version of the EventReporter Manual?
    • Can EventReporter Write to a UNC Path?
    • Which Database Format Should I Use with EventReporter?
    • Can EventReporter Work with Custom Event Logs?
    • How Do I Enter EventReporter License Information?
    • Is EventReporter v19+ supported on Windows Server IoT 2025?
  • Licensing and purchasing
    • How do I contact Adiscon sales?
    • What should I include in a quote request?
    • What happens after I open a sales ticket?
    • How do purchase orders and billing requests work?
    • Licensing and ordering
    • Air-gapped environments
    • Offline installation and activation
    • Online verification after activation
    • Perpetual licenses and UpgradeInsurance
    • UpgradeInsurance
  • Reference
    • EventReporter Shortcut Keys
    • Command Line Switches
    • Edition Comparison
    • Comparison of properties
    • Event Properties
      • Accessing Properties
        • Property
        • FromPos
        • ToPos
        • Options
        • Simple Examples
      • System Properties
      • Custom Properties
      • Event-Specific Properties
        • Standard Properties
        • Windows Event Log Properties
        • Windows Event Log V2 Properties
        • Syslog Message Properties
        • Disk Space Monitor
        • CPU/Memory Monitor
        • File Monitor
        • Windows Service Monitor
        • Ping Probe
        • Port Probe
        • Database Monitor
        • Serial Monitor
        • MonitorWare Echo Request
        • FTP Probe
        • IMAP Probe
        • NNTP Probe
        • SMTP Probe
        • POP3 Probe
        • HTTP Probe
    • Complex Filter Conditions
    • Connect to Computer
    • System Error Codes
    • Glossary
      • Database
      • Engine Only Install
      • IETF
      • IPv6
      • Registry File
      • Resource ID
      • RFC 3164
      • RFC 3195
      • RFC 5424
      • SETP
      • SMTP
      • Syslog
      • Syslog Facility
      • TCP
      • UDP
      • UTC
  • Copyrights
Back to top

Recommended Service Stop Order for EventReporter Maintenance#

Question#

What is the recommended order for stopping the EventReporter service during system maintenance or reboots?

Answer#

When performing system maintenance, updates, or planned reboots on a system running EventReporter, follow a specific shutdown sequence to prevent data loss and ensure a clean shutdown. The EventReporter service should be stopped after any web server and before the database server.

Recommended Stop Order#

  1. Stop IIS/Web Server (if using a web-based log viewer)

  2. Stop EventReporter Service

  3. Stop Database Server (SQL Server, MySQL, etc.)

Rationale#

This sequence ensures:

  • Web connections are closed first: Prevents new user sessions from accessing the database while EventReporter is still writing.

  • EventReporter stops gracefully: Allows EventReporter to complete any in-progress writes and flush its queues before the database becomes unavailable.

  • Database closes last: Ensures all pending transactions from EventReporter are committed before the database shuts down.

Stop Commands#

You can stop the EventReporter service using its internal service name AdisconEvntSLog in PowerShell or Command Prompt:

Command Prompt:

net stop w3svc
net stop "AdisconEvntSLog"
net stop MSSQLSERVER

PowerShell:

Stop-Service -Name "w3svc"
Stop-Service -Name "AdisconEvntSLog"
Stop-Service -Name "MSSQLSERVER"

Startup Order#

When starting services after maintenance, reverse the order:

  1. Start Database Server

  2. Start EventReporter Service

  3. Start IIS/Web Server

Command Prompt:

net start MSSQLSERVER
net start "AdisconEvntSLog"
net start w3svc

PowerShell:

Start-Service -Name "MSSQLSERVER"
Start-Service -Name "AdisconEvntSLog"
Start-Service -Name "w3svc"

Service Name Reference#

When managing the EventReporter service from the command line, use the internal service name:

  • Internal Service Name: AdisconEvntSLog

  • Display Name: EventReporter Service

The internal service name remains consistent across installations and should be used in automation scripts for reliability.

Verifying Service Status#

Get-Service -Name "AdisconEvntSLog"
sc query "AdisconEvntSLog"

Best Practices#

  • Plan maintenance windows: Schedule downtime during low-traffic periods to minimize event log message loss.

  • Backup database: Perform a database backup before shutting down services.

  • Verify connections: After restart, verify that the EventReporter service started correctly and is writing to the database.

  • Check logs: Review the Windows Event Viewer for any EventReporter service errors after restart.

  • Use internal service names: Always use the internal service name AdisconEvntSLog in scripts for reliability.

Troubleshooting#

If the EventReporter service does not stop gracefully:

  • Check for stuck processes in Task Manager.

  • Review the Windows Event Viewer for service errors.

  • Verify that database connections are properly closed.

  • Check service dependencies: sc qc "AdisconEvntSLog"

  • As a last resort, use force stop: net stop "AdisconEvntSLog" /y

Next
Running EventReporter on a Windows Cluster Server
Previous
Queue Buildup During SQL Server Table Cleanup Operations in EventReporter
Copyright © 1997-2026, Adiscon GmbH
Made with Sphinx and @pradyunsg's Furo
On this page
  • Recommended Service Stop Order for EventReporter Maintenance
    • Question
    • Answer
    • Recommended Stop Order
    • Rationale
    • Stop Commands
    • Startup Order
    • Service Name Reference
    • Verifying Service Status
    • Best Practices
    • Troubleshooting