Extended Events session file truncated on server restart

I have created an extended events session to capture login and logout information. The session is setup to store events to a file.
I understood that one of the advantages of using an event file (rather than a ring buffer) was that events history would be persistent across a restart.
However it appears that a new event file is created when SQL Server is restarted and the history is lost.
Is this expected? If so, what is the advantage of using a file rather than a ring buffer?

Based on your question (and additional comments regarding your setting of max_rollover_files to 1:


However it appears that a new event file is created when SQL Server is restarted and the history is lost. Is this expected?

Yes - that is expected. When you restarted SQL Server all currently running extended events were terminated. When you restarted SQL Server, a new extended event session started and your existing target file was replaced because you indicated you only wanted 1 file. If you want to preserve extended event data stored in target files across server restarts, you will have to increase the max_rollover_files to something greater than 1.

sys.fn_xe_file_target_read_file (path, mdpath, initial_file_name, initial_offset) has the capability of reading all extended event files in a the path referenced by mdpath if you specify null for the initial_file_name, so maintaining multple files should not be a problem.

Regarding the use of the Ring Buffer, take a look at why Jonathan Kehayias (world renowned expert in SQL Server Extended Events) Hates the ring buffer.

StackExchange Database Administrators Q#189386, answer score: 5