SQL server logs

Question

SQL server logs

SkyBVI

SSCoach

Points: 15128
More actions
September 14, 2010 at 10:33 am

#141928

Hi,
We are having a virtual machine which has sql server 2005 enterprise edition installed. I see in the sql server logs:-
/Message
Error: 18456, Severity: 14, State: 11.
Message
Login failed for user 'domainname\servername'. [CLIENT: 172.18.3.7]/
This server name is our production server.
These 2 messages are followed every minute.
So, every minute it tries to connect and logs gets filled up.
There's no way that our prod server should be communicating to this virtual machine.
What I did is completely unistalled the sql server 2005 from the virtual machine and now again installed it hoping that this error would fade away but i was wrong, it still persists...
how can i over come this error..
Regards,
Sushant
Regards
Sushant Kumar
MCTS,MCP

Viewing 13 posts - 1 through 12 (of 12 total)

You must be logged in to reply to this topic. Login to reply

steveb. SSC-Forever Points: 46733 More actions · Answer 1

There is something on your production server running that is trying connect, reinstalling the virtual server wont solve this, check the production server for agent jobs that may be trying to connect.

SQLBuddy123 One Orange Chip Points: 28294 More actions · Answer 2

It is the problem with the login that is trying to connect to the VM and not with the actual VM. So reinstall doesn't work.

First try to identify what the login 'domainname\servername' is trying to do on the VM SQL Server.

This could possibly be the SQL server service account (or Agent) trying to access the VM. Or it could be an app on the prod server. I'm not sure abt who and why.

If you still think that this login 'domainname\servername' should not access the VM SQL Server then you can disable it or remove it from the logins list.

Thank You,

Best regards,

SQLServer.

SkyBVI SSCoach Points: 15128 More actions · Answer 3

@ sqlbuddy

I already deleted that login. then also no difference

Regards,

Sushant

Regards
Sushant Kumar
MCTS,MCP

Nakul Vachhrajani SSChampion Points: 10294 More actions · Answer 4

I am leaning more on the human error phenomenon.

The first question is whether this is happening to only a few users or to all requests being handled by the production server.

If it is happening for all requests, I would first check if there is an alias somewhere on your systems? i.e. Is the production server forwarding the requests to the VM in question? To check this, go to the SQL Server Configuration Manager on the SQL Server, navigate to the SQL Server Native Client Configuration and clear out the Aliases from the "Aliases" tab.

If it is happening for a particular user, is this issue new? Chances are that if the VM was used for development/staging work, a developer/deployment engineer probably accidentally deployed a patch containing that local connection string onto the production server.

Thanks & Regards,
Nakul Vachhrajani.
http://nakulvachhrajani.com

Follow me on
Twitter: @sqltwins

SQLBuddy123 One Orange Chip Points: 28294 More actions · Answer 5

Then you need to identify the root cause. Find the actual app on the prod box that is using that login to connect to the VM and disable it from connecting to the VM.

Thank You,

Best Regards,

SQLBuddy

SkyBVI SSCoach Points: 15128 More actions · Answer 6

@ nakul

What do you mean by all users or some?

I just see the sql server logs and I find this error happeneing every minute

I also checked the aliases on both production server and VM and I found that there are no aliases on both server.

Regards,

Sushant

Regards
Sushant Kumar
MCTS,MCP

Nakul Vachhrajani SSChampion Points: 10294 More actions · Answer 7

SKYBVI (9/14/2010)
@ nakul
What do you mean by all users or some?
I just see the sql server logs and I find this error happeneing every minute
I also checked the aliases on both production server and VM and I found that there are no aliases on both server.
Regards,
Sushant

By All users, I mean that does this happen everytime somebody attempts a connection to the production server?

By some users, I mean that does this happen only when a specific user (may not be the actual user - can be the execution context of a service or something) attempts a connection.

Thanks & Regards,
Nakul Vachhrajani.
http://nakulvachhrajani.com

Follow me on
Twitter: @sqltwins

SkyBVI SSCoach Points: 15128 More actions · Answer 8

Is there a way to know which application on prod server is trying to connect to VM every minute..??

How to proceed?

Regards,

Sushant

Regards
Sushant Kumar
MCTS,MCP

Adiga One Orange Chip Points: 27284 More actions · Answer 9

Even if you drop the login, some application is trying to connect to this instance from 172.18.3.7. The only option to figure out is to check with the support team of 172.18.3.7 which application is running that user credentials

Pradeep Adiga
Blog: sqldbadiaries.com
Twitter: @pradeepadiga

Jeffrey Williams SSC Guru Points: 90303 More actions · Answer 10

SKYBVI (9/14/2010)
Is there a way to know which application on prod server is trying to connect to VM every minute..??
How to proceed?
Regards,
Sushant

Start up Profiler and trace the login event - hopefully you can capture the application that is trying to connect and get the application name.

You should check all agent jobs on production. See if there are any jobs that are running every minute that could be trying to access that system.

Check to see if you have a linked server created from prod to this VM. Might be someone who is trying to use the linked server.

And finally, check to see if anyone is logged into SSMS on the prod server with that username. If so, they could have activity monitor up and running - or have setup that server as a registered server. If it's a registered server - SSMS will poll the connection every minute to check the status of the system.

Jeffrey Williams
“We are all faced with a series of great opportunities brilliantly disguised as impossible situations.”

― Charles R. Swindoll

How to post questions to get better answers faster
Managing Transaction Logs

SkyBVI SSCoach Points: 15128 More actions · Answer 11

@jeffrey

I should start profiler and trace on login event on VM or on the Production server?

I saw a job on prod server that runs every minute, but i checked the code of it and nowhere it communicates with VM.

There is no linked server configured as the VM on the prod server.

Regards,

Sushant

Regards
Sushant Kumar
MCTS,MCP

SkyBVI SSCoach Points: 15128 More actions · Answer 12

@ any more clues

Regards,

Sushant

Regards
Sushant Kumar
MCTS,MCP