• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5478
  • Last Modified:

Failure Audit Event 18456

I notice in my logs that the WSUS isn't running and the Application Log is showing multiple instances of the attached error. I've searched online and the answers I've found don't really apply and haven't worked.

Windows SBS2003 with WSUS 3 installed.
Event Type:	Failure Audit
Event Source:	MSSQL$MICROSOFT##SSEE
Event Category:	(4)
Event ID:	18456
Date:		2/12/2009
Time:		11:47:30 AM
User:		NT AUTHORITY\SYSTEM
Computer:	KOLLE
Description:
Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: <named pipe>]
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00   .H......
0008: 14 00 00 00 52 00 45 00   ....R.E.
0010: 58 00 5c 00 4d 00 49 00   X.\.M.I.
0018: 43 00 52 00 4f 00 53 00   C.R.O.S.
0020: 4f 00 46 00 54 00 23 00   O.F.T.#.
0028: 23 00 53 00 53 00 45 00   #.S.S.E.
0030: 45 00 00 00 07 00 00 00   E.......
0038: 6d 00 61 00 73 00 74 00   m.a.s.t.
0040: 65 00 72 00 00 00         e.r...

Open in new window

0
MgBoonsboro
Asked:
MgBoonsboro
  • 14
  • 12
1 Solution
 
reb73Commented:
Is the named pipes protocol enabled in SQL Configuration Manager?
0
 
MgBoonsboroAuthor Commented:
It was not.  Should it be? I had not changed anything and all was working until about a day ago.

this is the latest error
Event Type:	Error
Event Source:	Windows Server Update Services
Event Category:	Update Services Service 
Event ID:	421
Date:		2/12/2009
Time:		12:39:07 PM
User:		N/A
Computer:	KOLLE
Description:
Connection to database failed. Reason=Cannot open database "SUSDB" requested by the login. The login failed.
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.. Connection string: Net=dbnmpntw;Data Source=\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query;;Initial Catalog=SUSDB;Connection Timeout=60;Application Name=WSUS SQL Connection;Trusted_Connection=Yes;Pooling='true'; Max Pool Size = 100
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Open in new window

0
 
reb73Commented:
But the connection string clearly uses the named pipes protocol (\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query)

Can you enable it and see if it sorts out the issue?
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
MgBoonsboroAuthor Commented:
It didn't work. I'm afraid I have little knowledge of MSSQL and SBS2003. This is a system I inherited.
0
 
reb73Commented:
Actually, the message 'Reason=Cannot open database "SUSDB" requested by the login' suggests that the problem could be with the database..

Was the SUSDB recently restored from a backup or is marked suspect?
0
 
MgBoonsboroAuthor Commented:
It has not been restored however the server crashed a few days ago. How can I check to see if it is suspect? There is no SQL Enterprise Manager but there is a SQL Configuration Manager.
0
 
reb73Commented:
There should be a SQL Management Studio which you can use to see if the database is greyed out.. If using Query window, the following command should help -

sp_helpdb

The Status columns will indicate whether the database is online/offline/suspect..

0
 
MgBoonsboroAuthor Commented:
Ah, ok. Using the Management Studio I can connect to other databaseses - like the SBSMonitoring database but when I try to connect to the WSUS database it throws this error:

Cannot connect to KOLLE\WSUS.
ADDITIONAL INFORMATION:

An error has occurred while establishing a connection to the server.  When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: SQL Network Interfaces, error: 26 - Error Locating Server/Instance Specified) (Microsoft SQL Server, Error: -1)

0
 
reb73Commented:
Right-click on SBSMonitoring database and create new database query.. Type the following command in the query window and check the status field for WSUS database..
0
 
reb73Commented:
sp_helpdb
0
 
MgBoonsboroAuthor Commented:
The WSUS db doesn't show up. In addition to the SBSMonitoring DB what looks like the default databases, MASTER, TEMP, etc. appear.
0
 
reb73Commented:
Are you logged in with 'sysadmin' privileges? If not, you will need to do so in order to troubleshoot this issue..
0
 
MgBoonsboroAuthor Commented:
Yes, I'm logged in at the server as administrator.
0
 
reb73Commented:
run the following command on query window -

exec sp_resetstatus 'WSUS'

See if that makes the database available..

If it does, run the DBCC CHECKDB command immediately using WSUS database..
0
 
MgBoonsboroAuthor Commented:
Well, it says the database doesn't exist. In looking for answers I came across some instances of WSUS being disabled by itself lately which doesn't inspire confidence!
0
 
reb73Commented:
Search for *.mdf/*.ldf files in the data/log folders in Windows (they are likely to be called WSUS.mdf and WSUS.ldf)
0
 
MgBoonsboroAuthor Commented:
I ran the WSUS Debug tool and got this:
Running... GetConfiguration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup
        :
        Version:3
        VersionString:3.1.6001.65
        ConfigurationSource:0
        ServicePackLevel:1
        TargetDir:C:\Program Files\Update Services\
        InstallType:1
        EnableRemoting:1
        WsusAdministratorsSid:S-1-5-21-1378598783-4138328431-151010624-1134
        WSUSReportersSid:S-1-5-21-1378598783-4138328431-151010624-3113
        SqlServerName:KOLLE\MICROSOFT##SSEE
        SqlAuthenticationMode:WindowsAuthentication
        SqlDatabaseName:SUSDB
        SqlUserName:
        SqlEncryptedPassword:
        SqlInstanceIsRemote:0
        wYukonInstalled:1
        IISInstallRevision:3.1.6001.65
        IISPreviousInstallRevision:
        IISUninstallConfigFilePath:C:\Program Files\Update Services\setup\Uninst
allSettings.xml
        IISTargetWebSiteCreated:False
        IISTargetWebSiteIndex:1457503085
        ContentDir:D:\WSUS
        SmtpUserPassword:AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAG19d6NqE7USTPTlzMDbrCgA
AAAACAAAAAAADZgAAqAAAABAAAABLL6/KpkfhpQjpCV5m2LKPAAAAAASAAACgAAAAEAAAALaJcbHf/yn
ZD5t/kk9aE20wAAAAsNHB1y+FFTO9j3q2I+EnejNpxox8oeTsTJ8zYuMQdntjx49LGcT9Xa4YIqa9J5/
fFAAAAEOKjO/8rrwj1/VyAywa6YgmTHQX
        ProxyPassword:
        PortNumber:8530
        EncryptionKey:System.Byte[]
        IIsDynamicCompression:-1
        EncryptionParam:System.Byte[]
        UsingSSL:0
        HostHeader:
Error processing node: GetConfiguration
System.Data.SqlClient.SqlException: Cannot open database "SUSDB" requested by th
e login. The login failed.
Login failed for user 'PHAC\Administrator'.
   at System.Data.SqlClient.ConnectionPool.GetConnection(Boolean& isInTransactio
n)
   at System.Data.SqlClient.SqlConnectionPoolManager.GetPooledConnection(SqlConn
ectionString options, Boolean& isInTransaction)
   at System.Data.SqlClient.SqlConnection.Open()
   at System.Data.SqlClient.SqlConnection.Open()
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect(String connec
tionString)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect()
   at Microsoft.UpdateServices.Internal.GenericDataAccess.ExecuteSP(String spNam
e, DBParameterCollection args, IExecuteSPHandler handler, Int32 queryTimeoutInSe
conds)
   at Microsoft.UpdateServices.Internal.GenericDataAccess.ExecuteSP(String spNam
e, DBParameterCollection args, IExecuteSPHandler handler)
   at Microsoft.UpdateServices.Internal.DataAccess.ExecuteSPMultipleResultSets(S
tring spName, DBParameterCollection args, Type[] resultTypes)
   at Microsoft.UpdateServices.Internal.DataAccess.ExecuteSPGetConfiguration()
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServerConfiguration.Load()
 
   at Microsoft.UpdateServices.Internal.BaseApi.UpdateServerConfiguration..ctor(
)
   at Microsoft.UpdateServices.Internal.ClassFactory.CreateWellKnownType(Type ty
pe, Object[] args)
   at Microsoft.UpdateServices.Internal.ClassFactory.CreateInstance(Type type, O
bject[] args)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect(String connec
tionString)
   at Microsoft.UpdateServices.DatabaseAccess.DBConnection.Connect()
   at Microsoft.SoftwareDistribution.Tools.SqlHandler.HandleQuery(TextWriter dat
aWriter, String baseDirectory, ArrayList sqlQueryList)
   at Microsoft.SoftwareDistribution.Tools.InstallConfiguration.DumpData(String
baseDirectory, String nodeName, XmlNode infoXml)
   at Microsoft.SoftwareDistribution.Tools.SusServerTool.ProcessDumpNode(XmlNode
 dumpNode)

Open in new window

0
 
reb73Commented:
That's obvious, since the WSUS database doesn't exist or is suspect ;-)

0
 
MgBoonsboroAuthor Commented:
It doesn't show up. I can try restoring from a backup. I've got one from Jan 8 handy.
0
 
reb73Commented:
I guess you could give it a try..
0
 
MgBoonsboroAuthor Commented:
Wait, I've found it - the db is SUSDB.MDF
0
 
reb73Commented:
Check for SUSDB.LDF.. If that is available as well, then you could just attach the database using SQL Management Studio..
0
 
MgBoonsboroAuthor Commented:
I'm trying that and getting this error:

Failed to retrieve data for this request. (Microsoft.SqlServer.Express.SmoEnum)

An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.Express.ConnectionInfo)
CREATE FILE encountered operating system error 32(The process cannot access the file because it is being used by another process.) while attempting to open or create the physical file 'D:\WSUS\UpdateServicesDbFiles\SUSDB.mdf'. (Microsoft SQL Server, Error: 5123)

0
 
reb73Commented:
That means SQL Server has a lock on it and is using it..

Is there more than one SQL Server Instance on the machine.. Looks like the database may be on another instance and not on the KOLLE instance..
0
 
MgBoonsboroAuthor Commented:
It looks like SBS2003 comes with some form of WSUS and it looks like whoever was here before installed a new instance of WSUS - why? Who knows but the last few updates may have broken something. I have a feeling i'd be better off trying to uninstall the whole mess and start over.
0
 
reb73Commented:
Look in the folder C:\Program Files\Microsoft SQL Server..

If there are two folders starting with the letters MSSQL, then there are two instances..
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 14
  • 12
Tackle projects and never again get stuck behind a technical roadblock.
Join Now