The database service on a production server restarted unexpectedly three times overnight. Users noticed brief outages, but no planned work was scheduled. What should the DBA do first to find the cause?
Select an answer to reveal the explanation.
Short Explanation
When the car stalls three times on the highway, you don't start swapping parts; you read the dashboard codes first. Your error log and the OS logs are those codes, and they usually tell you whether it was memory, storage, a crash or someone's script. Restoring from backup before you know what happened is like replacing the engine for a loose cable.
Full Explanation
Unexpected service restarts leave evidence. The database error log records startup and shutdown messages, fatal errors, stack dumps and resource exhaustion, while the operating system's logs record events such as out-of-memory process termination, storage errors, service control actions and host reboots. Correlating the entries around each restart time is the fastest way to identify whether the cause was a crash, a resource limit, a failing component, an automated update or an administrative action. Raising maximum memory without evidence is a guess that may make the problem worse; if the operating system was terminating the process due to memory pressure, giving the engine more memory would increase the risk. Rebuilding indexes addresses fragmentation, which affects query performance, but fragmentation does not cause the service to restart, and the rebuild consumes resources on an already unstable system. Restoring from a full backup is a drastic recovery step that discards recent changes; it is appropriate only after corruption has been confirmed and other options assessed, not as a first diagnostic action. Exam caveat: log review is both a troubleshooting step and a scheduled maintenance task; periodic review catches warning signs before they become outages. Operational check: export log entries from both sources for a window around each restart, build a timeline, identify the triggering event, and document the finding and fix in the incident record.