Post reply

logon failed error on error log

  • July 11, 2008 at 2:40 pm

    #195202

    Error log in sql server was bursting with logon msg for user.It is 5/6 every minute.

    "Login succeededed for user 'x'.COnnection:NotTrusted"

    This was "Error 18454" from the windows Event log.

    Then I dropped the user 'x' and related database for 'x'

    after verifying with management that this application is no more used.

    Then i started getting msg "Login failed for the user 'x'.COnnection:NotTrusted"

    This was "Error 18456" from the windows Event log. The msg is coming 5 to 10 every minute.

    Note that the message is for the same user'x'

    I am using sql server 2000 sp3.

  • July 11, 2008 at 2:58 pm

    #841835

    Set up profiler, monitor failed logins and make sure you get the hostname and applicationname columns. That should show you where the logins are coming from.

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass

  • July 11, 2008 at 2:59 pm

    #841836

    Either some application is trying to connect to the server using that, or some person is.

    Have you traced what that login is doing in the database and server? (Profiler or whatever else you prefer for that.)

    If you trace it, you could at least find out if it's a legitimate connection, or if it's some hacking attempt or some piece of obsolete software that's out of control.

    - Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
    Property of The Thread

    "Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

  • July 11, 2008 at 2:59 pm

    #841837

    Look in the SQL Server Log and see if it has additional information there about the failed login. If not, turn on login auditing for failed logins and it should give you the IP address of the machine trying to connect in the SQL Server log. You can also look at the "host" column in a profiler trace to see where the query is coming from. What you do after that depends on what kind of mood you are in and who owns the offending machine 🙂

    Hope this helps!

    Chad

  • July 11, 2008 at 3:01 pm

    #841844

    Thank you all for such quick response. I will try you suggestion and let you know. thanks

  • July 14, 2008 at 1:14 pm

    #842649

    Thank you. i run profile and able to find out the host machine and problem solved.

    i have simple question. What is connection: trusted and connection:non trusted that appears in errorlog for logon.

    Login succeeded for user 'sa'. Connection: Non-Trusted

  • July 14, 2008 at 4:11 pm

    #842743

    A trusted connection is one that used a windows account to connect to the SQL Server (e.g. domain\user). Non-trusted connections use a username and password to connect.

    Chad

  • July 15, 2008 at 1:59 pm

    #843390

    Thank you.

Viewing 8 posts - 1 through 7 (of 7 total)

You must be logged in to reply to this topic. Login to reply