June 22, 2006 at 9:51 pm
Hi
I have been getting following error each night sometimes between midnight and 3 am in the log file and this appears around 25 times within 15 minutes.
login failed for user "sa"
I tried running profiler to get node/application/server etc information but everything comes as NULL.
For last some days I have also started getting another error message in the log file
Login falied for user 'NT AUTHORITY\SYSTEM"
Please advice how can I find the source for these errors?
Thanks
June 22, 2006 at 10:13 pm
Do you have any jobs that normally run between midnight and 3 AM? If so, are any of them failing? Were any new processes or applications put into place recently?
If you're not getting the information from Profiler, you can run a packet sniffer, but you're probably going to need to be around to stop the sniffer before the packets are out of the buffer.
K. Brian Kelley
@kbriankelley
June 23, 2006 at 1:16 am
Hi,
We faced the same problem last month in our db what we found was their where few web task job's running under SA account & the task was failing because we removed the built-in/administrator from SQL server.
Solution: - Change the job to run under other user & give writes to user for execute sp called by the job.
------------
Prakash Sawant
http://psawant.blogspot.com
June 23, 2006 at 12:45 pm
Thanks for the help Brian and Prakash.
I have many jobs that run during that time but they have been running fine and this message was not coming earlier and we haven't changed any job recently.
The only thing that I think happened around the time when these messages started coming is "changing the password for the 'sa' user".
I will check all these jobs/steps again and probabbly I will try to stop "agent" during that time to make sure that it is indeed coming from some jobs.
Thanks Again.
Viewing 4 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply