Andreas.Wolter (9/26/2013)
jasona.work (9/26/2013)
Is there a way to determine, when an account attempts to open a DB and fails, which DB it was trying to open?Possibly via a server-side trace?
...
If you are on >= SQL 2008 Enterprise you can use the Auditing feature.
In SQL 2012 the Server level part is even available in standard edition.
That would in my eyes be the easiest way plus have the least overhead.
A SQL Trace is possible, too if you don't have that option. There you would use the "Audit Login Failed" event.
It shoul all be in the Errorlog as well though. So if it is really missing completely, there might be something else going on..
Hmm. I like the idea of the audit feature, would this be the "C2 audit tracing?" If so, there was a note from a previous DBA that they did not enable this due to performance implications.
There is a trace running, which does capture login failed events (as does the login auditing,) which did not show a DB name. So I'm now wondering if perhaps someone typoed the DB name in a connection string and was trying to connect to a non-existent, never existed DB (rather than DBName they put in dbame)
Thanks!