September 9, 2010 at 7:48 am
Hello, I have a question about the NT AUTHORITY\NETWORK
SERVICE account. We recently upgraded to SQL 2005 and we don't use the report services yet.
We have a daily trace running against our production database that captures all "unauthorized" activity to the database and produces a report. Over the last couple days, the NT AUTHORITY\NETWORK SERVICE account has been showing up on the report accessing the ReportServer database and the number of accesses has been in the thousands.
We've been up and running since June and have never seen this activity on the server until a few days ago. I did however open the report portal html page for the report server 2 days ago. This is the only corrolation.
It does not appear to be a problem and nothing is being affected by it (I don't think) but I'm just curious as to why the NT AUTHORITY\NETWORK SERVICE is accessing the ReportServer database so frequently when we don't even use the report services.
When I check our trace table I'm seeing thousands of entries that look like this:
textdataapplicationnameloginname
-- network protocol: LPC set quoted_identifier on set arithabort off set numeric_roundabort off set ansi_warnings on set ansi_padding on set ansi_nulls on set concat_null_yields_null on set cursor_close_on_commit off set implicit_transactions off set language us_english set dateformat mdy set datefirst 7 set transaction isolation level read committed Report ServerNT AUTHORITY\SYSTEM
September 9, 2010 at 2:06 pm
If you stop the report services service
display name:
SQL Server Reporting Services (MSSQLSERVER)
Do the entries stop?
September 10, 2010 at 8:17 am
I wish I could check... I'm a developer, so I don't have permission on production to start and stop services.
Today however, there were no logins from yesterday. But in the activity monitor I can see that the last batch was executed this morning. There are three process threads showing up in the monitor now for the report server.
So, I dunno... I just thought it was wierd that I saw login activity from that account to the report server for 2 days ...first day was 800+ logins and second day was 1000+ logins. But today, there was nothing from yesterday. Kinda odd to me.
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply