Click here to monitor SSC
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Management/SQL Server Logs


Management/SQL Server Logs

Author
Message
wwei
wwei
SSC Rookie
SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)

Group: General Forum Members
Points: 49 Visits: 452
Hi All,

Our sever logs show a lot login failed Messages, we actually don't feel we have login problems. Even during night times, we believe no body works on, no SSIS package is scheduled. Following are examples, it happened to all the databases in the server.

09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'DBNAME1'. [CLIENT: XXX.XX.X.XX]
09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.
09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'DBNAME2'. [CLIENT: XXX.XX.X.XX]
09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.
09/11/2013 00:12:49,Logon,Unknown,Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'ReportServer'. [CLIENT: XXX.XX.X.XX]
09/11/2013 00:12:49,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State: 38.

Can anyone let me know probably what causes this issue? Thanks in advance!
rajborntodare
rajborntodare
SSC-Enthusiastic
SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)SSC-Enthusiastic (111 reputation)

Group: General Forum Members
Points: 111 Visits: 510
If that user is un authorized or not required, Disable him at the security of particular database

i have no great ideas at the reporting server

Hehe
Tommy Bollhofer
Tommy Bollhofer
Ten Centuries
Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)Ten Centuries (1.2K reputation)

Group: General Forum Members
Points: 1166 Visits: 3359
If you are uncertain as to the source, might want to start by launching a command prompt and issuing a ping -a XXX.XXX.XXX to identify the source. Once you have identifed the source, be it a front-end application, SSRS, etc. verify the credentials being used to authenticate to the database engine. Based on the last entry, you might want to take a look at the reporting services configuration manager and verify the credentials it is using to authenticate to the ReportServer database.

http://technet.microsoft.com/en-us/library/ms156305.aspx

Tommy

Follow @sqlscribe
GilaMonster
GilaMonster
SSC-Forever
SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)

Group: General Forum Members
Points: 47267 Visits: 44392
Something running as the local system is trying to log into your server and access the databases. Could be a service running as SYSTEM, could be an application, but the former is more likely.


Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass


wwei
wwei
SSC Rookie
SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)SSC Rookie (49 reputation)

Group: General Forum Members
Points: 49 Visits: 452
Thank you for helping me on this issue.

I set a trace on SQL Profiler for EventClass of 'Uer Error Messate' and 'Audit Login Failed'. Got many error messages about 'changed database context to 'dbname' '; and many login failed for ApplicationName of 'Microsoft ® Windows Script Host'...

Here are some examples:

<Event id="162" name="User Error Message">
<Column id="1" name="TextData">Changed language setting to us_english.</Column>
<Column id="9" name="ClientProcessID">9076</Column>
<Column id="6" name="NTUserName">SYSTEM</Column>
<Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>
<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>
<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>
<Column id="12" name="SPID">94</Column>
</Event>
<Event id="162" name="User Error Message">
<Column id="1" name="TextData">Changed database context to 'master'.</Column>
<Column id="9" name="ClientProcessID">8508</Column>
<Column id="6" name="NTUserName">SYSTEM</Column>
<Column id="14" name="StartTime">2013-09-11T14:42:49.397-05:00</Column>
<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>
<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>
<Column id="12" name="SPID">95</Column>
</Event>


<Event id="20" name="Audit Login Failed">
<Column id="1" name="TextData">Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database 'model'. [CLIENT: XXXXXXX]</Column>
<Column id="9" name="ClientProcessID">4824</Column>
<Column id="6" name="NTUserName">SYSTEM</Column>
<Column id="14" name="StartTime">2013-09-11T15:27:49.22-05:00</Column>
<Column id="10" name="ApplicationName">Microsoft ® Windows Script Host</Column>
<Column id="11" name="LoginName">NT AUTHORITY\SYSTEM</Column>
<Column id="12" name="SPID">88</Column>
</Event>
Erland Sommarskog
Erland Sommarskog
SSC Eights!
SSC Eights! (937 reputation)SSC Eights! (937 reputation)SSC Eights! (937 reputation)SSC Eights! (937 reputation)SSC Eights! (937 reputation)SSC Eights! (937 reputation)SSC Eights! (937 reputation)SSC Eights! (937 reputation)

Group: General Forum Members
Points: 937 Visits: 866
Beside checking SQL Server Agent for jobs, also check Task Manager in Windows.

Erland Sommarskog, SQL Server MVP, www.sommarskog.se
GilaMonster
GilaMonster
SSC-Forever
SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)SSC-Forever (47K reputation)

Group: General Forum Members
Points: 47267 Visits: 44392
So you're looking for some scheduled windows script that's running against your databases. I would look first at Windows Scheduler, see what's in there.


Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass


Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search