interesting security message in profiler

Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

All Forums

SQL Server 2000 Forums

SQL Server Administration (2000)

interesting security message in profiler

Author

Topic

spirit1
Cybernetic Yak Master

11752 Posts

Posted - 2006-01-19 : 05:52:25

the query is run from an OR mapper and it's a big thing.
i basicaly has a bunch of left joins but we don't know how exactly it looks. thus the use of Profiler.
and when this query is executed this apperas in TextData column instead of the query:


-- 'password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons.

event class = SQL:BatchCompleted

it's a normal row in profiler like most others with exception of that message...

emm.... how, what, umpf???

Go with the flow & have fun! Else fight the flow

mr_mist
Grunnio

1870 Posts

Posted - 2006-01-19 : 06:05:51

It's a security feature of Profiler to prevent it logging password changes. Maybe there is a comment in your procedure that includes the line.

-------
Moo. :)

spirit1
Cybernetic Yak Master

11752 Posts

Posted - 2006-01-19 : 06:12:41

emm... security feature.. ok...
what kind of comment???

because if i run
select DS_Password as Password from MyTable

i get this line in profiler with no problem.

the original query is a select not an update/insert

Go with the flow & have fun! Else fight the flow

TimS
Posting Yak Master

198 Posts

Posted - 2006-01-19 : 08:29:23

It the password change command, IIRC sp_password

Try

select DS_Password as sp_password from MyTable

Tim S

spirit1
Cybernetic Yak Master

11752 Posts

Posted - 2006-01-19 : 08:33:56

ok cool... that gave me the same mesage...
i'm gonna kick some serious ass if we have this in our query!!!

any more keywords as sp_password?

[EDIT]
ok i get


SQL:BatchCompleted	
-- 'sp_password' was found in the text of this event.
-- The text has been replaced with this comment for security reasons.

but before i got 'password' not 'sp_password'

that's why i wanted to know for other keywords.
[/EDIT]
Go with the flow & have fun! Else fight the flow

Subscribe to SQLTeam.com

SQLTeam.com Articles via RSS

SQLTeam.com Weblog via RSS

- Advertisement -

Resources