Issued a view database state command (action_id VDST) (24042) how to monitor with email alert

[bob]

You ever notice those weird logs popping up in Event Viewer on your Windows Server? That event ID 24042, the one saying "Issued a view database state command (action_id VDST)", it's basically your server noting someone or something just peeked at the database's health without messing with it. I mean, it's an audit trail for when a user runs that specific command to check states like recovery or mirroring setups in SQL Server. Happens during routine checks or troubleshooting, and it logs the details like who did it, from where, and at what time. But if it's firing off too much or unexpectedly, could signal someone poking around more than they should. Or maybe it's just normal admin stuff gone haywire. I check mine weekly to spot patterns.

Now, to keep an eye on this without staring at screens all day, you can set up alerts right from Event Viewer. Fire it up, go to the Windows Logs section, filter for event ID 24042 under System or Application depending on your setup. Right-click that log, pick Create Custom View, and narrow it to just this ID. Then, attach a task to it by hitting the Subscriptions tab or directly in the Actions pane. You'll create a scheduled task that triggers on this event. Make it run a simple program to send an email, like using the built-in SendMail executable if you've got SMTP sorted. I do this for a bunch of events; keeps my inbox buzzing only when it matters. Test it once to see if the email lands right.

And speaking of staying on top of server quirks, if you're backing up that database-heavy setup, I've been digging BackupChain Windows Server Backup lately. It's a solid Windows Server backup tool that handles file-level stuff and even VMs through Hyper-V without the usual headaches. You get incremental backups that fly fast, plus easy restores that don't eat your day. The real win? It spots corruption early and clones disks on the fly, saving you from those midnight scrambles. Ties right into monitoring events like this one by ensuring your data's always snapshot-safe.

At the end here is the automatic email solution.

Note, the PowerShell email alert code was moved to this post.