Unexpected Second Instance of SQL Started We had an occurrence of our main production server C:\ filling unexpectedly, and our support guy fixed it by fixing the size of the page file and rebooting.  I'm trying to diagnose why this grew from almost no usage to 100gb over the space of a couple of days.

I'm currently going back through logs, and a Spotlight server we run over it - and I noticed that the server had a second instance of sqlservr.exe started.

Our main instance runs "c:...\sqlservr.exe" -sINSTANCE as a service MSSQL$INSTANCE.

The second instance showing in the task listing shows "c:...\sqlservr.exe" -sINSTANCE, but not as a service.

I can't imagine why a second instance would have started - could it be an agent job, such as our Ola Hallengren scripts working externally, but reporting in our task manager as a second instance?

The thing here is that this is one artifact I'm seeing to diagnose the problem, but in itself it isn't reporting major memory usage - I am seeing regular pagefaults, pagefile growth, etc, starting when this appears however.

This is a curveball that I wasn't expecting and I'd appreciate any help, ideas, thoughts, or other diagnosis points you think I should be looking for.

SQL Server 2014, working on a Windows Cluster.
It turns out - when reviewing all the logging that I could, that the Windows Event Log has a crash of SQL recorded - however, SQL itself has no crash in its logs, and the log wasn't closed and a new one created as you'd expect when SQL restarts.

In our monitoring, the second instance never grows beyond 2gb of RAM - and the RAM usage itself never grows, but the pagefile grew at 11gb per day.

I can't see the cause of the crash, and I'd probably have to open a Microsoft support ticket to see why it crashed, created a new instance, but never closed the existing instance - never released it from being the instance as the service, and never died or took over that I can see.

We can see some timeouts for a minute from an API that talks to the server, but no "unavailable" messages.

It seems like the crash is the underlying cause - but that's as far as I can determine for now, and it seems unusual to me.

None of our monitoring, or our consultants monitoring picked up the crash.