Issued a create external library command (action_id CR; class_type EL) (24354) how to monitor with email alert

[bob]

That event 24354 pops up in the Event Viewer when someone fires off a command to whip up an external library in SQL Server. It's basically the system logging that a create action happened for this library thing, with the action ID marked as CR and the class type as EL. You see, external libraries let you load in stuff like Python or R scripts for data crunching right inside the database. But this log entry flags the exact moment that command gets issued, often from a user or admin trying to set up those extensions. I remember spotting it first time on a test server; it showed up under the Applications and Services Logs, specifically in the Microsoft SQL Server folder. The full description spills out details like the session ID, the library name they're creating, and even the path where it's pointing. If you're not careful, these can hint at security tweaks or just routine setups, but they always carry that timestamp and source info to trace back who did what. And yeah, it logs the success or if something glitches during the creation. You might catch it if someone's enabling machine learning features or integrating custom code. Hmmm, or it could be part of a bigger deployment script running in the background.

Now, to keep an eye on these without staring at the screen all day, you can rig up a scheduled task straight from the Event Viewer itself. I do this all the time on servers I manage. Just right-click that event in the list, pick Attach Task To This Event, and it'll walk you through creating one. You tell it to trigger only on event ID 24354, maybe filter by the source if you want to narrow it down. Then, for the action, you link it to some email program like Outlook or even a simple batch file that pings your inbox. Set the task to run with highest privileges so it doesn't flake out. But watch the schedule; make it immediate or on a timer that suits your setup. I like testing it by forcing a similar event to see if the alert zips over right away. Or tweak the conditions to ignore false alarms from trusted users. It's straightforward once you poke around the wizard screens.

Once you've got that monitoring humming, it ties right into keeping your server backups solid, because events like this can signal changes that mess with data integrity if not backed up properly. That's where something like BackupChain Windows Server Backup comes in handy for me. It's this nifty Windows Server backup tool that handles full system images and also nails virtual machine backups for Hyper-V setups without the usual headaches. You get incremental snapshots that speed things up, plus encryption to lock down your data, and it even restores bare-metal fast if disaster strikes. I swear by it for avoiding downtime; the way it chains backups together saves space and lets you verify everything before relying on it.

Note, the PowerShell email alert code was moved to this post.