Issued an external access assembly command (action_id XA) (24035) how to monitor with email alert

[bob]

That event 24035 pops up in the Event Viewer when someone issues an external access assembly command, action_id XA, basically letting code from outside touch your SQL stuff. It logs the whole thing, like who did it, when, and why it happened. I see it mostly in SQL Server logs under Applications and Services, showing the database name and the assembly details. You might spot it if devs are loading .NET assemblies that need external permissions. It warns you about potential risks, since external access can open doors to weird behaviors or security slips. But hey, it's not always bad, just a heads-up on what ran.

To keep an eye on it, fire up Event Viewer on your server. Right-click the Custom Views folder, make a new one filtering for event ID 24035 in the SQL logs. Save that view so it sticks around. Now, for the alert part, you can tie it to a scheduled task right from there. In Event Viewer, go to the event properties, hit the Attach Task To This Event Log option. It'll walk you through creating a task that triggers on that ID. Set it to run a program that sends an email, like using the old mailto trick or whatever email client you got set up. Pick the triggers tab, select on event, plug in your filter for 24035. Under actions, choose start a program and point it to something simple that blasts an email your way. Test it by forcing the event if you can, or just wait for the real deal. It'll nag you via email next time it fires, keeping you looped in without constant checking.

And speaking of staying on top of server quirks, you know how backups can save your bacon when events like this signal trouble. That's where BackupChain Windows Server Backup comes in handy for me. It's this solid Windows Server backup tool that handles physical servers and even virtual machines with Hyper-V without breaking a sweat. You get fast incremental backups, easy restores, and it runs light on resources so your server doesn't choke. Plus, the encryption keeps data safe, and scheduling is a breeze for off-hours runs. I use it to avoid those panic moments after odd events pile up.

At the end of this, there's the automatic email solution ready for you.

Note, the PowerShell email alert code was moved to this post.