| Author |
Topic |
|
funketekun
Constraint Violating Yak Guru
491 Posts |
 Posted - 2007-07-11 : 10:16:33
|
| sql profiler shows eventclass "audit login failed" on the same server i changed the sa password on an average of every 20 minutes.I cant find out how is this application using the sa password. The application name is SQL Server.Any ideas?=============================http://www.sqlserverstudy.com |
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2007-07-11 : 11:17:46
|
| haven't we been down this road before?do you have some maintainance tasks or scheduled that are trying to run?service broker queues?is your server a linked server to another sql server that is trying to use sa??_______________________________________________Causing trouble since 1980blog: http://weblogs.sqlteam.com/mladenp |
 |
|
|
funketekun
Constraint Violating Yak Guru
491 Posts |
Posted - 2007-07-11 : 11:47:41
|
| yes, but i never got the answer.do you have some maintainance tasks or scheduled that are trying to run?all the jobs are fine. they dont fail.service broker queues?what is service broker queues?is your server a linked server to another sql server that is trying to use sa??its a normal sql server box=============================http://www.sqlserverstudy.com |
|
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2007-07-11 : 12:05:55
|
> what is service broker queues?ok i guess you don't then  > its a normal sql server boxa linked server is a normal sql server box.what is the host name and database id of the process that does the audit login failed?look at the ExistingConnection event. what protocol does it use tcp/ip or LPC(shared memory) ?_______________________________________________Causing trouble since 1980blog: http://weblogs.sqlteam.com/mladenp |
|
|
|
rmiao
Master Smack Fu Yak Hacker
7266 Posts |
Posted - 2007-07-11 : 12:26:12
|
| How does sql agent conenct to sql server? |
|
|
|
funketekun
Constraint Violating Yak Guru
491 Posts |
|
|
SwePeso
Patron Saint of Lost Yaks
30421 Posts |
Posted - 2007-07-11 : 13:13:20
|
| I guess you could try to run Profiler and see which logins are used. Then have a look at which application that tries to use the SA account.Peter LarssonHelsingborg, Sweden |
|
|
|
funketekun
Constraint Violating Yak Guru
491 Posts |
Posted - 2007-07-12 : 08:37:16
|
| on SProfiler, Sql Server is using the SA password on the same box. But I don't have SQL Server open.=============================http://www.sqlserverstudy.com |
|
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2007-07-12 : 09:36:10
|
| look at the IsSystem column in your profiler trace for your failed login.is it 1 (system) or 0 (user) ?_______________________________________________Causing trouble since 1980blog: http://weblogs.sqlteam.com/mladenp |
|
|
|
funketekun
Constraint Violating Yak Guru
491 Posts |
|
|
spirit1
Cybernetic Yak Master
11752 Posts |
Posted - 2007-07-13 : 08:12:21
|
| that would be nice to konw from the start..._______________________________________________Causing trouble since 1980blog: http://weblogs.sqlteam.com/mladenp |
|
|
|
SwePeso
Patron Saint of Lost Yaks
30421 Posts |
Posted - 2007-07-13 : 08:14:05
|
quote:
Originally posted by funketekun
on SProfiler, Sql Server is using the SA password on the same box. But I don't have SQL Server open.
Do you really mean that SQL Server service is NOT running and still someone is trying to access with SA account?Peter LarssonHelsingborg, Sweden |
|
|
|
SwePeso
Patron Saint of Lost Yaks
30421 Posts |
Posted - 2007-07-13 : 08:17:01
|
| You also might want to revise the answer in Q&A topic for item #4.INSERT #TempEXEC dbo.uspMySP 1, 2, 3works very well.Peter LarssonHelsingborg, Sweden |
|
|
|
|
sa password