security_error_ring_buffer_recorded in system health log - what does it mean?

Question

Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012.

Today I was checking the log files located in:

"C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Log"

and I found this strange thing in the event log called "system_health":

security_error_ring_buffer_recorded

Clicking on it gave me additional information:

api_name            ImpersonateSecurityContext
call_stack          0x6E2715B4FB0700007C36FBB3FB070000A553FBB3FB070000... <- this one continues forever
calling_api_name    NLShimImpersonate
error_code          5023
id                  0
session_id          51
time_stamp          190360

It wouldn't bother me so much if it wasn't for the "error" and "recorded" part... that doesn't sound good.

This event is occurring every hour every day, sometimes with minutes in between and other times it's occurring a hundred times in a few seconds.

This is the first time I've checked these log-files.

Can someone please explain to me what this is and how to "fix" it, if this is even necessarry?

EDIT:

Alongside this event there are also one called:

"scheduler_monitor_system_health_ring_buffer_recorded"

Clicking on it shows "page_faults" to be 8913. Now that doesn't sound too good either.

Solution

What is a ring buffer?

A ring buffer is a fixed size of memory which is used for inter-thread or inter-process communication. Essentially, information is written to the ring buffer, and when the system reaches the end, it begins writing at the beginning again. There is also a shared pointer which points to the current head of the buffer.

Meanwhile the reading thread, reads from the beginning, and tries to keep up with the writer. If the writer process overtakes the reader, then events/data will be lost, but at least you can carry on.

Generally the size of the buffer is such that this will not happen unless Bad Things occur.

Ring buffers are used in situations when losing events is not fatal, and other forms of queue management have bigger problems.

What does this event mean then?

It means there is a ring buffer to which security errors are being written. An another thread is reading the ring buffer, and recording the information to a log file. Which is what is supposed to happen.

It isn't an error. It is detailed logging telling you what it is doing with the security errors (e.g. failed logins) to make sure they don't get lost.

Comments

[Levi Johansen]

Thanks for the reply! So it simply telling me that it just logged a "something"... sounds quite harmless. The reason I even asked is because our sql-server is running very slowly at times and I thought this might be the reason for it.