Link to home
Start Free TrialLog in
Avatar of MgBoonsboro
MgBoonsboro

asked on

Failure Audit Event 18456

I notice in my logs that the WSUS isn't running and the Application Log is showing multiple instances of the attached error. I've searched online and the answers I've found don't really apply and haven't worked.

Windows SBS2003 with WSUS 3 installed.
Event Type:	Failure Audit
Event Source:	MSSQL$MICROSOFT##SSEE
Event Category:	(4)
Event ID:	18456
Date:		2/12/2009
Time:		11:47:30 AM
User:		NT AUTHORITY\SYSTEM
Computer:	KOLLE
Description:
Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: <named pipe>]
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00   .H......
0008: 14 00 00 00 52 00 45 00   ....R.E.
0010: 58 00 5c 00 4d 00 49 00   X.\.M.I.
0018: 43 00 52 00 4f 00 53 00   C.R.O.S.
0020: 4f 00 46 00 54 00 23 00   O.F.T.#.
0028: 23 00 53 00 53 00 45 00   #.S.S.E.
0030: 45 00 00 00 07 00 00 00   E.......
0038: 6d 00 61 00 73 00 74 00   m.a.s.t.
0040: 65 00 72 00 00 00         e.r...

Open in new window

Avatar of reb73
reb73
Flag of Ireland image

Is the named pipes protocol enabled in SQL Configuration Manager?
Avatar of MgBoonsboro
MgBoonsboro

ASKER

It was not.  Should it be? I had not changed anything and all was working until about a day ago.

this is the latest error
Event Type:	Error
Event Source:	Windows Server Update Services
Event Category:	Update Services Service 
Event ID:	421
Date:		2/12/2009
Time:		12:39:07 PM
User:		N/A
Computer:	KOLLE
Description:
Connection to database failed. Reason=Cannot open database "SUSDB" requested by the login. The login failed.
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.. Connection string: Net=dbnmpntw;Data Source=\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query;;Initial Catalog=SUSDB;Connection Timeout=60;Application Name=WSUS SQL Connection;Trusted_Connection=Yes;Pooling='true'; Max Pool Size = 100
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Open in new window

But the connection string clearly uses the named pipes protocol (\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query)

Can you enable it and see if it sorts out the issue?
It didn't work. I'm afraid I have little knowledge of MSSQL and SBS2003. This is a system I inherited.
Actually, the message 'Reason=Cannot open database "SUSDB" requested by the login' suggests that the problem could be with the database..

Was the SUSDB recently restored from a backup or is marked suspect?
It has not been restored however the server crashed a few days ago. How can I check to see if it is suspect? There is no SQL Enterprise Manager but there is a SQL Configuration Manager.
There should be a SQL Management Studio which you can use to see if the database is greyed out.. If using Query window, the following command should help -

sp_helpdb

The Status columns will indicate whether the database is online/offline/suspect..

Ah, ok. Using the Management Studio I can connect to other databaseses - like the SBSMonitoring database but when I try to connect to the WSUS database it throws this error:

Cannot connect to KOLLE\WSUS.
ADDITIONAL INFORMATION:

An error has occurred while establishing a connection to the server.  When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: SQL Network Interfaces, error: 26 - Error Locating Server/Instance Specified) (Microsoft SQL Server, Error: -1)

Right-click on SBSMonitoring database and create new database query.. Type the following command in the query window and check the status field for WSUS database..
sp_helpdb
The WSUS db doesn't show up. In addition to the SBSMonitoring DB what looks like the default databases, MASTER, TEMP, etc. appear.
Are you logged in with 'sysadmin' privileges? If not, you will need to do so in order to troubleshoot this issue..
Yes, I'm logged in at the server as administrator.
run the following command on query window -

exec sp_resetstatus 'WSUS'

See if that makes the database available..

If it does, run the DBCC CHECKDB command immediately using WSUS database..
Well, it says the database doesn't exist. In looking for answers I came across some instances of WSUS being disabled by itself lately which doesn't inspire confidence!
Search for *.mdf/*.ldf files in the data/log folders in Windows (they are likely to be called WSUS.mdf and WSUS.ldf)
I ran the WSUS Debug tool and got this:
Running... GetConfiguration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup
        :
        Version:3
        VersionString:3.1.6001.65
        ConfigurationSource:0
        ServicePackLevel:1
        TargetDir:C:\Program Files\Update Services\
        InstallType:1
        EnableRemoting:1
        WsusAdministratorsSid:S-1-5-21-1378598783-4138328431-151010624-1134
        WSUSReportersSid:S-1-5-21-1378598783-4138328431-151010624-3113
        SqlServerName:KOLLE\MICROSOFT##SSEE
        SqlAuthenticationMode:WindowsAuthentication
        SqlDatabaseName:SUSDB
        SqlUserName:
        SqlEncryptedPassword:
        SqlInstanceIsRemote:0
        wYukonInstalled:1
        IISInstallRevision:3.1.6001.65
        IISPreviousInstallRevision:
        IISUninstallConfigFilePath:C:\Program Files\Update Services\setup\Uninst
allSettings.xml
        IISTargetWebSiteCreated:False
        IISTargetWebSiteIndex:1457503085
        ContentDir:D:\WSUS
        SmtpUserPassword:AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG19d6NqE7USTPTlzMDbrCgA
AAAACAAAAAAADZgAAqAAAABAAAABLL6/KpkfhpQjpCV5m2LKPAAAAAASAAACgAAAAEAAAALaJcbHf/yn
ZD5t/kk9aE20wAAAAsNHB1y+FFTO9j3q2I+EnejNpxox8oeTsTJ8zYuMQdntjx49LGcT9Xa4YIqa9J5/
fFAAAAEOKjO/8rrwj1/VyAywa6YgmTHQX
        ProxyPassword:
        PortNumber:8530
        EncryptionKey:System.Byte[]
        IIsDynamicCompression:-1
        EncryptionParam:System.Byte[]
        UsingSSL:0
        HostHeader:
Error processing node: GetConfiguration
System.Data.SqlClient.SqlException: Cannot open database "SUSDB" requested by th
e login. The login failed.
Login failed for user 'PHAC\Administrator'.
   at System.Data.SqlClient.ConnectionPool.GetConnection(Boolean& isInTransactio
n)
   at System.Data.SqlClient.SqlConnectionPoolManager.GetPooledConnection(SqlConn
ectionString options, Boolean& isInTransaction)
   at System.Data.SqlClient.SqlConnection.Open()
   at System.Data.SqlClient.SqlConnection.Open()
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect(String connec
tionString)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect()
   at Microsoft.UpdateServices.Internal.GenericDataAccess.ExecuteSP(String spNam
e, DBParameterCollection args, IExecuteSPHandler handler, Int32 queryTimeoutInSe
conds)
   at Microsoft.UpdateServices.Internal.GenericDataAccess.ExecuteSP(String spNam
e, DBParameterCollection args, IExecuteSPHandler handler)
   at Microsoft.UpdateServices.Internal.DataAccess.ExecuteSPMultipleResultSets(S
tring spName, DBParameterCollection args, Type[] resultTypes)
   at Microsoft.UpdateServices.Internal.DataAccess.ExecuteSPGetConfiguration()
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServerConfiguration.Load()
 
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServerConfiguration..ctor(
)
   at Microsoft.UpdateServices.Internal.ClassFactory.CreateWellKnownType(Type ty
pe, Object[] args)
   at Microsoft.UpdateServices.Internal.ClassFactory.CreateInstance(Type type, O
bject[] args)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect(String connec
tionString)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect()
   at Microsoft.SoftwareDistribution.Tools.SqlHandler.HandleQuery(TextWriter dat
aWriter, String baseDirectory, ArrayList sqlQueryList)
   at Microsoft.SoftwareDistribution.Tools.InstallConfiguration.DumpData(String
baseDirectory, String nodeName, XmlNode infoXml)
   at Microsoft.SoftwareDistribution.Tools.SusServerTool.ProcessDumpNode(XmlNode
 dumpNode)

Open in new window

That's obvious, since the WSUS database doesn't exist or is suspect ;-)

It doesn't show up. I can try restoring from a backup. I've got one from Jan 8 handy.
I guess you could give it a try..
Wait, I've found it - the db is SUSDB.MDF
Check for SUSDB.LDF.. If that is available as well, then you could just attach the database using SQL Management Studio..
I'm trying that and getting this error:

Failed to retrieve data for this request. (Microsoft.SqlServer.Express.SmoEnum)

An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.Express.ConnectionInfo)
CREATE FILE encountered operating system error 32(The process cannot access the file because it is being used by another process.) while attempting to open or create the physical file 'D:\WSUS\UpdateServicesDbFiles\SUSDB.mdf'. (Microsoft SQL Server, Error: 5123)

That means SQL Server has a lock on it and is using it..

Is there more than one SQL Server Instance on the machine.. Looks like the database may be on another instance and not on the KOLLE instance..
It looks like SBS2003 comes with some form of WSUS and it looks like whoever was here before installed a new instance of WSUS - why? Who knows but the last few updates may have broken something. I have a feeling i'd be better off trying to uninstall the whole mess and start over.
ASKER CERTIFIED SOLUTION
Avatar of reb73
reb73
Flag of Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial