Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
jhnegrao
Yak Posting Veteran
81 Posts |
 Posted - 2007-10-01 : 11:50:36
|
| Hello, All!I've been receiving an incredible amount of event in SQL SErver Error Log as following:Login failed for user 'BR\CA-INTRA1A$'Where 'BR\CA-INTRA1A$' is a IIS Server.Has Anybody had the same problems before? Anybody has any suggestion to try solving that?I've been receiving about 4000 error like that. This error happen every minute at the same second.Thanksjuliano Horta |
|
|
Kristen
Test
22859 Posts |
Posted - 2007-10-01 : 12:18:24
|
Sounds like the port SQL Server is using is "open" and some port-scanner is trying to break in.Usual way of dealing with this is to keep the blighters out with a firewall; move SQL Server "listener" to a high port number (above 10,000 - the scanners don;t usually bother to got hat high); or better still "both of those"  Kristen |
 |
|
|
jhnegrao
Yak Posting Veteran
81 Posts |
Posted - 2007-10-01 : 14:50:07
|
| Hi, Kristen!How can I trace this? |
|
|
|
Kristen
Test
22859 Posts |
Posted - 2007-10-01 : 14:58:45
|
| Sounds like you are already! - in the sense that you have Failed Logins turned on.You could also use SQL Profiler to see all the Login events, but I expect that's a waste of time as it looks like your server is being swamped by failed-login-attempts, and you urgently need to just "disallow" them.If you are CERTAIN (and I mean 100% CERTAIN!!) that these login attempts can only be internal, and you just need to find the errant process that is using an incorrect password, and looping round incessantly, then I expect that SQL Profiler would give you a clue as to who the "caller" isKristen |
|
|
|
|
|
|
Huge amount of events in SQL Error Log