疑似Windows server自动更新引发的sqlserver宕机

问题背景：客户反馈凌晨三点sql server宕机，需要排查宕机原因 1> sql server 日志如下: 日志如下： 09/29/2019 23:38:00,Logon,未知,Login failed for user 'oasa'. 原因: 无法打开明确指定的数据库“dbname”。 [客户端: xx.x.xx.xxx] 09/29/2019 23:38:00,Logon,未知,错误: 18456，严重性: 14，状态: 38。 09/29/2019 23:37:59,Server,未知,This instance of SQL Server last reported using a process ID of 1956 at 2019/9/29 23:36:38 (local) 2019/9/29 15:36:38 (UTC). This is an informational message only; no user action is required. 09/29/2019 23:37:18,Server,未知,Using conventional memory in the memory manager. 09/29/2019 23:37:18,Server,未知,Detected 65535 MB of RAM. This is an informational message; no user action is required. 09/29/2019 23:37:17,Server,未知,Microsoft SQL Server 2012 - 11.0.5058.0 (X64) <nl/> May 14 2014 18:34:29 <nl/> Copyright (c) Microsoft Corporation<nl/> Enterprise Edition (64-bit) on Windows NT 6.3 <X64> (Build 9600: ) (Hypervisor) 09/29/2019 23:36:39,spid13s,未知,The SQL Server Network Interface library could not deregister the Service Principal Name (SPN) [ MSSQLSvc/KWG-KG-OADB01.kwgproperty.com:1433 ] for the SQL Server service. Error: 0xffffffff<c/> state: 63. Administrator should deregister this SPN manually to avoid client authentication errors. 09/29/2019 23:36:39,spid13s,未知,The SQL Server Network Interface library could not deregister the Service Principal Name (SPN) [ MSSQLSvc/KWG-KG-OADB01.kwgproperty.com ] for the SQL Server service. Error: 0xffffffff<c/> state: 63. Administrator should deregister this SPN manually to avoid client authentication errors. 09/29/2019 23:36:39,spid7s,未知,SQL Trace was stopped due to server shutdown. Trace ID = '1'. This is an informational message only; no user action is required. 09/29/2019 23:36:39,spid7s,未知,SQL Server shutdown has been initiated 09/29/2019 23:36:38,spid7s,未知,.NET Framework runtime has been stopped. 09/29/2019 23:36:38,spid21s,未知,The current event was not reported to the Windows Events log. Operating system error = (null). You may need to clear the Windows Events log if it is full. 09/29/2019 23:36:38,spid21s,未知,Error: 17054<c/> Severity: 16<c/> State: 1. 09/29/2019 23:36:38,spid21s,未知,Service Broker manager has shut down. 09/29/2019 23:36:38,Server,未知,SQL Server is terminating because of a system shutdown. This is an informational message only. No user action is required.   关键报错 09/29/2019 04:00:13,spid414,未知,AppDomain 2 (mssqlsystemresource.dbo[runtime].1) created. 09/29/2019 03:09:56,Server,未知,Software Usage Metrics is enabled. 09/29/2019 03:09:29,spid7s,未知,Launched startup procedure 'sp_MSrepl_startup'. 09/29/2019 03:09:29,spid109,未知,Using 'xplog70.dll' version '2011.110.5058' to execute extended store SQL Server is terminating because of a system shutdown  关键的报错信息 2> sql server宕机是由于系统引起的，查看Windows server的系统日志 怀疑和服务器的自动检查更新有关，关闭自动检查更新，数据库服务正常运行十几天无告警，基本可以确认是由于服务器自动更新引起的数据库宕机。