'sa' user is "pinging" my Azure SQL Database

• Tautvydas

  SSC Rookie

  Points: 32

  More actions

  December 15, 2022 at 10:27 am

  #4125952

  I have a Azure SQL Database with Auditing turned on. I noticed that my database comes online after a pause when it shouldn't. I checked the audit logs and it shows strange entries of 'sa' login trying to do smth. Not sure what these entries mean. Is a normal activity from Azure or somebody is trying to connect to my database? I believe that there is no such user 'sa' on Azure SQL databases, or am I wrong. Attaching the screenshot of audit logs.

  Additional_info column shows these values (they repeat for every event).

  <action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data">destroyed</action_info> <action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data">event disabled</action_info> <action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data">event enabled<startup_type>automatic</startup_type></action_info>

  

  Attachments:

  You must be logged in to view attached files.

• Site Owners

  SSC Guru

  Points: 80305

  More actions

  December 16, 2022 at 11:10 am

  #4126474

  Thanks for posting your issue and hopefully someone will answer soon.

  This is an automated bump to increase visibility of your question.