Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

Management/SQL Server Logs Expand / Collapse
Author
Message
Posted Wednesday, September 11, 2013 10:09 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Wednesday, January 15, 2014 8:12 AM
Points: 49, Visits: 448
Hi All,

Our sever logs show a lot login failed Messages, we actually don't feel we have login problems. Even during night times, we believe no body works on, no SSIS package is scheduled. Following are examples, it happened to all the databases in the server.

09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'DBNAME1'. [CLIENT: XXX.XX.X.XX]
09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.
09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'DBNAME2'. [CLIENT: XXX.XX.X.XX]
09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.
09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: XXX.XX.X.XX]
09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.

Can anyone let me know probably what causes this issue? Thanks in advance!
Post #1493785
Posted Wednesday, September 11, 2013 11:34 AM
SSC-Enthusiastic

SSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-Enthusiastic

Group: General Forum Members
Last Login: Tuesday, February 11, 2014 10:12 AM
Points: 110, Visits: 501
If that user is un authorized or not required, Disable him at the security of particular database

i have no great ideas at the reporting server

Post #1493826
Posted Wednesday, September 11, 2013 11:42 AM


Ten Centuries

Ten CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen CenturiesTen Centuries

Group: General Forum Members
Last Login: 2 days ago @ 9:16 AM
Points: 1,157, Visits: 3,263
If you are uncertain as to the source, might want to start by launching a command prompt and issuing a ping -a XXX.XXX.XXX to identify the source. Once you have identifed the source, be it a front-end application, SSRS, etc. verify the credentials being used to authenticate to the database engine. Based on the last entry, you might want to take a look at the reporting services configuration manager and verify the credentials it is using to authenticate to the ReportServer database.

http://technet.microsoft.com/en-us/library/ms156305.aspx


Tommy

Post #1493829
Posted Wednesday, September 11, 2013 12:56 PM


SSC-Forever

SSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-Forever

Group: General Forum Members
Last Login: Today @ 4:17 AM
Points: 43,042, Visits: 36,197
Something running as the local system is trying to log into your server and access the databases. Could be a service running as SYSTEM, could be an application, but the former is more likely.


Gail Shaw
Microsoft Certified Master: SQL Server 2008, MVP
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass

Post #1493860
Posted Wednesday, September 11, 2013 3:13 PM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Wednesday, January 15, 2014 8:12 AM
Points: 49, Visits: 448
Thank you for helping me on this issue.

I set a trace on SQL Profiler for EventClass of 'Uer Error Messate' and 'Audit Login Failed'. Got many error messages about 'changed database context to 'dbname' '; and many login failed for ApplicationName of 'Microsoft ® Windows Script Host'...

Here are some examples:

<Event id="162" name="User Error Message">
<Column id="1" name="TextData">Changed language setting to us_english.</Column>
<Column id="9" name="ClientProcessID">9076</Column>
<Column id="6" name="NTUserName">SYSTEM</Column>
<Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>
<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>
<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>
<Column id="12" name="SPID">94</Column>
</Event>
<Event id="162" name="User Error Message">
<Column id="1" name="TextData">Changed database context to 'master'.</Column>
<Column id="9" name="ClientProcessID">8508</Column>
<Column id="6" name="NTUserName">SYSTEM</Column>
<Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>
<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>
<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>
<Column id="12" name="SPID">95</Column>
</Event>


<Event id="20" name="Audit Login Failed">
<Column id="1" name="TextData">Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'model'. [CLIENT: XXXXXXX]</Column>
<Column id="9" name="ClientProcessID">4824</Column>
<Column id="6" name="NTUserName">SYSTEM</Column>
<Column id="14" name="StartTime">2013-09-11T15:27:49.22-05:00</Column>
<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>
<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>
<Column id="12" name="SPID">88</Column>
</Event>
Post #1493916
Posted Wednesday, September 11, 2013 3:33 PM


SSC Eights!

SSC Eights!SSC Eights!SSC Eights!SSC Eights!SSC Eights!SSC Eights!SSC Eights!SSC Eights!

Group: General Forum Members
Last Login: Monday, September 15, 2014 4:57 AM
Points: 802, Visits: 717
Beside checking SQL Server Agent for jobs, also check Task Manager in Windows.

Erland Sommarskog, SQL Server MVP, www.sommarskog.se
Post #1493927
Posted Wednesday, September 11, 2013 4:30 PM


SSC-Forever

SSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-ForeverSSC-Forever

Group: General Forum Members
Last Login: Today @ 4:17 AM
Points: 43,042, Visits: 36,197
So you're looking for some scheduled windows script that's running against your databases. I would look first at Windows Scheduler, see what's in there.


Gail Shaw
Microsoft Certified Master: SQL Server 2008, MVP
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass

Post #1493941
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse