Post reply

Management/SQL Server Logs

  • September 11, 2013 at 10:09 am

    #279601

    Hi All,

    Our sever logs show a lot login failed Messages, we actually don't feel we have login problems. Even during night times, we believe no body works on, no SSIS package is scheduled. Following are examples, it happened to all the databases in the server.

    09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'DBNAME1'. [CLIENT: XXX.XX.X.XX]

    09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.

    09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'DBNAME2'. [CLIENT: XXX.XX.X.XX]

    09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.

    09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: XXX.XX.X.XX]

    09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.

    Can anyone let me know probably what causes this issue? Thanks in advance!

  • September 11, 2013 at 11:34 am

    #1649437

    If that user is un authorized or not required, Disable him at the security of particular database

    i have no great ideas at the reporting server

    :hehe:

  • September 11, 2013 at 11:42 am

    #1649440

    If you are uncertain as to the source, might want to start by launching a command prompt and issuing a ping -a XXX.XXX.XXX to identify the source. Once you have identifed the source, be it a front-end application, SSRS, etc. verify the credentials being used to authenticate to the database engine. Based on the last entry, you might want to take a look at the reporting services configuration manager and verify the credentials it is using to authenticate to the ReportServer database.

    http://technet.microsoft.com/en-us/library/ms156305.aspx

    Tommy

    Follow @sqlscribe

  • September 11, 2013 at 12:56 pm

    #1649461

    Something running as the local system is trying to log into your server and access the databases. Could be a service running as SYSTEM, could be an application, but the former is more likely.

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass

  • September 11, 2013 at 3:13 pm

    #1649509

    Thank you for helping me on this issue.

    I set a trace on SQL Profiler for EventClass of 'Uer Error Messate' and 'Audit Login Failed'. Got many error messages about 'changed database context to 'dbname' '; and many login failed for ApplicationName of 'Microsoft ® Windows Script Host'...

    Here are some examples:

    <Event id="162" name="User Error Message">

    <Column id="1" name="TextData">Changed language setting to us_english.</Column>

    <Column id="9" name="ClientProcessID">9076</Column>

    <Column id="6" name="NTUserName">SYSTEM</Column>

    <Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>

    <Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>

    <Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>

    <Column id="12" name="SPID">94</Column>

    </Event>

    <Event id="162" name="User Error Message">

    <Column id="1" name="TextData">Changed database context to 'master'.</Column>

    <Column id="9" name="ClientProcessID">8508</Column>

    <Column id="6" name="NTUserName">SYSTEM</Column>

    <Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>

    <Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>

    <Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>

    <Column id="12" name="SPID">95</Column>

    </Event>

    <Event id="20" name="Audit Login Failed">

    <Column id="1" name="TextData">Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'model'. [CLIENT: XXXXXXX]</Column>

    <Column id="9" name="ClientProcessID">4824</Column>

    <Column id="6" name="NTUserName">SYSTEM</Column>

    <Column id="14" name="StartTime">2013-09-11T15:27:49.22-05:00</Column>

    <Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>

    <Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>

    <Column id="12" name="SPID">88</Column>

    </Event>

  • September 11, 2013 at 3:33 pm

    #1649515

    Beside checking SQL Server Agent for jobs, also check Task Manager in Windows.

    [font="Times New Roman"]Erland Sommarskog, SQL Server MVP, www.sommarskog.se[/font]

  • September 11, 2013 at 4:30 pm

    #1649528

    So you're looking for some scheduled windows script that's running against your databases. I would look first at Windows Scheduler, see what's in there.

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply