Default event_file path for Extended Events

Foreword

Have you ever wondered where the .xel file is saved when you create a new Extended Event session and don't specify the full path (just the file name)?

Like so:

Well, so did I and here's what I've found out.

Test

Let's run our tests on a local instance because we'll have to restart it at some point.

CREATE EVENT SESSION [TestFileTarget] ON SERVER 
ADD EVENT sqlserver.sql_statement_completed
ADD TARGET package0.event_file
(
    SET filename=N'TestFileTarget',max_file_size=(2)
)
WITH (STARTUP_STATE = ON)

I created the session via GUI and then scripted it out. You can see that even the scripted version contains only the file name.

We have to start the session if we want to find out through TSQL where the file is saved.

ALTER EVENT SESSION [TestFileTarget] ON SERVER
STATE = START

That populates the sys.dm_xe_sessions DMV, and we can find the current location with this snippet.

; -- Previous statement must be properly terminated
WITH xeTargets
AS
(
    SELECT
        s.name
        , t.target_name
        , CAST(t.target_data AS xml) AS xmlData
    FROM
        sys.dm_xe_session_targets AS t
        JOIN sys.dm_xe_sessions AS s
            ON s.address = t.event_session_address
)
SELECT
    xt.name
    , xt.target_name
    , xNodes.xNode.value('@name', 'varchar(250)') AS filePath
    , xt.xmlData
FROM xeTargets AS xt
/* OUTER APPLY if you want to see other sessions */
CROSS APPLY xt.xmlData.nodes('.//File') AS xNodes (xNode)

This is my result; your path will be different:

Let's look into that folder (use your favourite explorer or cmd line).

Get-ChildItem -Path "D:\SqlServer\MSSQL16.MSSQLSERVER\MSSQL\Log" | Select-Object Name

I can see there are several files:

• errorlog
• errorlog.1
• HkEngineEventFile_0_133143177576200000.xel
• log.trc
• system_health_0_133143177578450000.xel
• TestFileTarget_0_133143178669430000.xel

It seems like it's in the same folder as the errorlog. So let's change the errorlog's path and see if XE event files are also affected.

The error log's path is a SQL Server startup parameter. And this is the relevant excerpt from the documentation (emphasis mine).

Is the fully qualified path for the error log file (typically, C:\Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\ERRORLOG).
If you do not provide this option, the existing registry parameters are used.

To change the startup parameter, I'll use Configuration Manager.
Right-click the SQL Server service, select Properties and then go to the Startup Parameters tab.

Let's change the folder to something else.

I'm changing it to -eD:\ErrorLog\Errorlog, a new folder I've created.

This change requires SQL Server service restart, so let's do that as well.

Since we've specified the WITH (STARTUP_STATE = ON), the event is running. So we can check the path with the previously mentioned snippet.

But if we check the old errorlog folder, we can see that the old error log and XE files are still there. This is because they are not cleaned up automatically.

As you would expect, reading from the XE file shows only the rows stored in the new location, so be mindful of that.

Bonus test

If you don't have the SQL Server installed locally, don't worry. We can test it even faster in Docker. I'm using the latest image mcr.microsoft.com/mssql/server:2022-latest but feel free to use a different one if you already have it locally.

docker run `
-e 'ACCEPT_EULA=Y' `
-e 'MSSQL_SA_PASSWORD=Password5' `
-e 'MSSQL_PID=Developer' `
-p 14338:1433 `
-d `
--name xefilepath `
mcr.microsoft.com/mssql/server:2022-latest

I'll get this result by running the first few steps from the earlier demo (creating and starting the session + finding the file location).

That's the default error log path on Linux. But I can change that with an environment variable.

Let's remove the container and recreate it with the variable MSSQL_ERROR_LOG_FILE.

docker rm -f xefilepath

docker run `
-e 'ACCEPT_EULA=Y' `
-e 'MSSQL_SA_PASSWORD=Password5' `
-e 'MSSQL_PID=Developer' `
-e MSSQL_ERROR_LOG_FILE='/var/opt/mssql/dontblink/errorlog' `
-p 14338:1433 `
-d `
--name xefilepath `
mcr.microsoft.com/mssql/server:2022-latest

Since we removed the container, we have to recreate the session again. When we do that, we can see that the Extended Event file is created in the expected folder.

The takeaway: when you skip the full path, event_file lands wherever the error log lives. Specify a full path and you control it yourself - but if you leave it to the default, it follows the error log location. Change that via Configuration Manager on Windows or MSSQL_ERROR_LOG_FILE in Docker, and your default XE file location moves with it.

If you're new to Extended Events sessions, Investigating errors with Extended Events is a practical place to start.

Thank you for reading