Login Events 18453 & 18454 won't go away

Question

Login Events 18453 & 18454 won't go away

jwhite-614767

Old Hand

Points: 318
More actions
January 25, 2008 at 7:33 am

#202717

I'm rather new to SQL Administration (*rather meaning within the last 5 weeks), and I need help identifying where the Application log is rgrabbing Events 18453 and 18454 -- Successful Logins. The server's Application Event Viewer is flooded with these, leaving room for little else.
I've already been through the SQL Server Properties in Management Studio and set the Login Auditing section to "Failed Logins Only", but his hasn't made any difference.
I've spent several hours investigating Internet search results, to no avail.
Has anyone experienced (and resolved) this problem? Is it simply a matter of making a change somewhere else?
Any assistance is appreciated

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Brandie Tarvin SSC Guru Points: 172995 More actions · Answer 1

jwhite,

It's probably a global policy or local policy object that's grabbing this information. The Application Log audits stuff based on what the OS / Domain Security Policies are set to. You might want to grab your server admin and ask them if they are auditing all login events.

You can look at the server's local policies by going to Administrative Tools, Local Security settings. Open up Local Policies -> Audit Policy to see what the local machine is logging. Remember, though, this policy can be overridden by GPOs in the domain which dictate how all servers act.

Brandie Tarvin, MCITP Database AdministratorLiveJournal Blog: http://brandietarvin.livejournal.com/[/url]On LinkedIn!, Google+, and Twitter.Freelance Writer: ShadowrunLatchkeys: Nevermore, Latchkeys: The Bootleg War, and Latchkeys: Roscoes in the Night are now available on Nook and Kindle.

TeeSQL Valued Member Points: 54 More actions · Answer 2

I'm having the same issue... the excessive logging is taking place in the Applications log not the Security Log...

Domain Policy for audit would not cause this within the Application Log unless it's object and process audit, which are off...

Note:

1)The logging is only taking place on 1 instance (4 other instances are resident on the same node)

2) SQL Security Logging is set to (None)

Any other ideas...

Brandie Tarvin SSC Guru Points: 172995 More actions · Answer 3

Start a new thread for your issue. You'll be more likely to get people to respond. A lot of people here ignore old threads.

Brandie Tarvin, MCITP Database AdministratorLiveJournal Blog: http://brandietarvin.livejournal.com/[/url]On LinkedIn!, Google+, and Twitter.Freelance Writer: ShadowrunLatchkeys: Nevermore, Latchkeys: The Bootleg War, and Latchkeys: Roscoes in the Night are now available on Nook and Kindle.

Joie Andrew One Orange Chip Points: 27360 More actions · Answer 4

Are any XEvents or SQL Server Audits setup? Could be done for some kind of compliance.

Joie Andrew
"Since 1982"