{"id":1130,"date":"2020-07-29T11:54:30","date_gmt":"2020-07-29T18:54:30","guid":{"rendered":"http:\/\/3.209.169.194\/blogs\/erin\/?p=1130"},"modified":"2020-07-29T11:54:30","modified_gmt":"2020-07-29T18:54:30","slug":"the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it","status":"publish","type":"post","link":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/","title":{"rendered":"The security_error_ring_buffer_recorded event and why you don\u2019t need it"},"content":{"rendered":"

 <\/p>\n

I recently ran through a health audit for a customer, and in reviewing their system_health output I was reminded of the unnecessary security_error_ring_buffer_recorded event.\u00a0 That\u2019s right: you don\u2019t need it in your system_health session.<\/p>\n

Jonathan and I have talked about this numerous times, but neither of us have ever written about it.\u00a0 In the case of our Remote DBA customers, we remove security_error_ring_buffer_recorded event from the system_health event session on all instances we access.\u00a0 I\u2019m typically not someone that recommends altering what ships and runs by default by Microsoft, but in this case, I\u2019m all for it.\u00a0 Aaron Bertrand recently blogged about options for improving the system_health session<\/a> and included this same suggestion.<\/p>\n

Event Frequency<\/h2>\n

In Aaron\u2019s post he refers to the security_error_ring_buffer_recorded event as \u201cunactionable noise\u201d, and frankly I can\u2019t think of a better term for it.\u00a0 I\u2019ve never used it to troubleshoot it any authentication\/security issue, and I\u2019m very confident that Microsoft isn\u2019t using it in its current state either.\u00a0 In terms of the volume of that event, for the new client system that I looked at recently the five system_health files covered about four (4) hours of time.\u00a0 Of the 1,851,741 million events captured in that time frame, the security_error_ring_buffer_recorded event showed up 1,838,882 times.\u00a0 That\u2019s 99.3% of the events\u2026absolute noise.<\/p>\n

To check how frequently security_error_ring_buffer_recorded event shows up in your system health, simply browse out to the Log folder for the SQL Server instance and open one of the system_health*.xel files in Management Studio.\u00a0 Then, right-click on the name column and select Group by this Column.<\/p>\n

\"Extended<\/a>
Extended Events file – Group by this Columns<\/figcaption><\/figure>\n

 <\/p>\n

Once the events are grouped, check the number of entries for the security_error_ring_buffer_recorded event.<\/p>\n

\"XE<\/a>
XE Grouped Events<\/figcaption><\/figure>\n

 <\/p>\n

A Quick Fix<\/h2>\n

Assuming your frequency is just as high, remove the event it from the system_health session.\u00a0 The command is simple:<\/p>\n

ALTER EVENT SESSION [system_health] ON SERVER
\nDROP EVENT sqlserver.security_error_ring_buffer_recorded;
\nGO<\/p>\n

You do not need to stop and re-start the event session; you can run this and it will immediately take effect.\u00a0 Once you make that change, take note of the time span your event sessions start to cover, and what events become more frequent.\u00a0 Hopefully this creates a more useful data collection that you can use when troubleshooting.<\/p>\n","protected":false},"excerpt":{"rendered":"

  I recently ran through a health audit for a customer, and in reviewing their system_health output I was reminded of the unnecessary security_error_ring_buffer_recorded event.\u00a0 That\u2019s right: you don\u2019t need it in your system_health session. Jonathan and I have talked about this numerous times, but neither of us have ever written about it.\u00a0 In the […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37],"tags":[],"yoast_head":"\nThe security_error_ring_buffer_recorded event and why you don\u2019t need it - Erin Stellato<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The security_error_ring_buffer_recorded event and why you don\u2019t need it - Erin Stellato\" \/>\n<meta property=\"og:description\" content=\"  I recently ran through a health audit for a customer, and in reviewing their system_health output I was reminded of the unnecessary security_error_ring_buffer_recorded event.\u00a0 That\u2019s right: you don\u2019t need it in your system_health session. Jonathan and I have talked about this numerous times, but neither of us have ever written about it.\u00a0 In the […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/\" \/>\n<meta property=\"og:site_name\" content=\"Erin Stellato\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-29T18:54:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-content\/uploads\/2020\/07\/XE_groupby.jpg\" \/>\n<meta name=\"author\" content=\"Erin Stellato\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Erin Stellato\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/\",\"url\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/\",\"name\":\"The security_error_ring_buffer_recorded event and why you don\u2019t need it - Erin Stellato\",\"isPartOf\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/#website\"},\"datePublished\":\"2020-07-29T18:54:30+00:00\",\"dateModified\":\"2020-07-29T18:54:30+00:00\",\"author\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/#\/schema\/person\/76170223ffffa1df03fd9be5b66cb158\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The security_error_ring_buffer_recorded event and why you don\u2019t need it\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/#website\",\"url\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/\",\"name\":\"Erin Stellato\",\"description\":\"The SQL Sequel\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/#\/schema\/person\/76170223ffffa1df03fd9be5b66cb158\",\"name\":\"Erin Stellato\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0c8b485bd54ea26b57e99f79b525f409?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0c8b485bd54ea26b57e99f79b525f409?s=96&d=mm&r=g\",\"caption\":\"Erin Stellato\"},\"sameAs\":[\"http:\/\/3.209.169.194\/blogs\/erin\"],\"url\":\"https:\/\/www.sqlskills.com\/blogs\/erin\/author\/erin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The security_error_ring_buffer_recorded event and why you don\u2019t need it - Erin Stellato","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/","og_locale":"en_US","og_type":"article","og_title":"The security_error_ring_buffer_recorded event and why you don\u2019t need it - Erin Stellato","og_description":"  I recently ran through a health audit for a customer, and in reviewing their system_health output I was reminded of the unnecessary security_error_ring_buffer_recorded event.\u00a0 That\u2019s right: you don\u2019t need it in your system_health session. Jonathan and I have talked about this numerous times, but neither of us have ever written about it.\u00a0 In the […]","og_url":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/","og_site_name":"Erin Stellato","article_published_time":"2020-07-29T18:54:30+00:00","og_image":[{"url":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-content\/uploads\/2020\/07\/XE_groupby.jpg"}],"author":"Erin Stellato","twitter_misc":{"Written by":"Erin Stellato","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/","url":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/","name":"The security_error_ring_buffer_recorded event and why you don\u2019t need it - Erin Stellato","isPartOf":{"@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/#website"},"datePublished":"2020-07-29T18:54:30+00:00","dateModified":"2020-07-29T18:54:30+00:00","author":{"@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/#\/schema\/person\/76170223ffffa1df03fd9be5b66cb158"},"breadcrumb":{"@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/the-security_error_ring_buffer_recorded-event-and-why-you-dont-need-it\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sqlskills.com\/blogs\/erin\/"},{"@type":"ListItem","position":2,"name":"The security_error_ring_buffer_recorded event and why you don\u2019t need it"}]},{"@type":"WebSite","@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/#website","url":"https:\/\/www.sqlskills.com\/blogs\/erin\/","name":"Erin Stellato","description":"The SQL Sequel","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sqlskills.com\/blogs\/erin\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/#\/schema\/person\/76170223ffffa1df03fd9be5b66cb158","name":"Erin Stellato","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.sqlskills.com\/blogs\/erin\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0c8b485bd54ea26b57e99f79b525f409?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0c8b485bd54ea26b57e99f79b525f409?s=96&d=mm&r=g","caption":"Erin Stellato"},"sameAs":["http:\/\/3.209.169.194\/blogs\/erin"],"url":"https:\/\/www.sqlskills.com\/blogs\/erin\/author\/erin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/posts\/1130"}],"collection":[{"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/comments?post=1130"}],"version-history":[{"count":0,"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/posts\/1130\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/media?parent=1130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/categories?post=1130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/erin\/wp-json\/wp\/v2\/tags?post=1130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}