November 18, 2011 at 9:19 am
I have set up an alert for error 18456. I get an error that the login failed for SA every hour. I ran the profiler to see what was running in order for the login to fail. Looks like it's this: EXECUTE msdb.dbo.sp_sqlagent_has_server_access @login_name = N'sa'
I have changed the password and it still fails.
Any ideas on what is going on?
November 18, 2011 at 11:32 am
Other than that, Does somewhere the 'sa' password is hard coded??
Regards,
Skybvi
Regards
Sushant Kumar
MCTS,MCP
November 21, 2011 at 6:47 am
it could be but when i did a profiler the only procedure that came up was the check sql server agent has rights procedure and I changed the SA password to be the one it should be. I didn't change it to something new.
November 22, 2011 at 9:54 am
If you are auditing failed logins, the IP address of the offending machine should appear in the Windows Application event log. Do a
ping -a <ipaddress>
example:
ping -a 172.169.1.1
and see what the computer name is. This is how I trace things back to what (who) is attempting the login.
Hope that helps.
November 22, 2011 at 2:13 pm
it's the server itself that is trying to loging using the sa login and password, that's why i ran profiler
just confused...
November 22, 2011 at 2:29 pm
Is it the server, or a program on the server? I believe the EventSource in the Event Log should give a clue as to the program that is doing it.
November 23, 2011 at 3:40 am
Do you have any jobs that are failing where the job owner is 'sa'
November 23, 2011 at 5:16 am
i will check the event log.
There are no jobs that are failing, that's why this is even more confusing
November 23, 2011 at 6:50 am
looks like sqlevn70.dll is the culprit.
Should i download software to repair it?
Viewing 9 posts - 1 through 8 (of 8 total)
You must be logged in to reply to this topic. Login to reply