January 5, 2006 at 5:05 pm
Hello!
I'm getting an avalanche of this error in the Event Viewer in one of my servers, wich is fulling the event viewer application log.
The error message is:
*****
Event Type:Information Event Source:MSSQLSERVER Event Category:(4) Event ID:17055 Date:04/01/2006 Time:06:19:39 p.m. User:N/A Computer:SSJDSQLTEST Description: 18456 : Login failed for user 'NT AUTHORITY\SYSTEM'. Data: 0000: 18 48 00 00 0e 00 00 00 .H...... 0008: 0c 00 00 00 53 00 53 00 ....S.S. 0010: 4a 00 44 00 53 00 51 00 J.D.S.Q. 0018: 4c 00 54 00 45 00 53 00 L.T.E.S. 0020: 54 00 00 00 07 00 00 00 T....... 0028: 6d 00 61 00 73 00 74 00 m.a.s.t. 0030: 65 00 72 00 00 00 e.r...
*******
The request seems to be generated inside the same server. And both SQL Server and SQL Agent are running smoothly with an specific domain account.
Do you have any clue of what can be happening?
January 5, 2006 at 5:21 pm
Has the BUILTIN\Administrators group been removed from being able to logon to the SQL Server? If so, do you have the full text search service installed?
K. Brian Kelley
@kbriankelley
January 6, 2006 at 3:18 am
Do you use MOM2005 to monitor the system ? I remember a script in MOM 2005 which (sometimes) generates this error. The script is called "SQL Server 2000 Replication Monitoring". If you don't run replication, this script seems to create this error on some systems like every 30 minutes.
If this is what's happening in your case I would advice to simply disable this script in MOM.
Markus
[font="Verdana"]Markus Bohse[/font]
January 6, 2006 at 10:51 am
No, I have not MOM, but Brian's proposal about Full Text made me look the service list.
...And found a LogPI agent that shouldn't be there anymore. Stopped it and the event seems to be gone!
Thanks!
Viewing 4 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply