Solved

MS SQL Server 2005 Event ID: 18456 / Event ID: 18454

Posted on 2013-05-11
1
1,757 Views
Last Modified: 2013-06-13
Hi Experts!

I got this information inside Event Viewer -> Windows Logs -> Application

Log Name:      Application
Source:        MSSQLSERVER
Date:          5/12/2013 12:41:22 AM
Event ID:      18456
Task Category: (4)
Level:         Information
Keywords:      Classic,Audit Failure
User:          N/A
Computer:      Keywordserver
Description:
Login failed for user 'sa'. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="49152">18456</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0x90000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-11T16:41:22.000Z" />
    <EventRecordID>204233209</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Keywordserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>sa</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>184800000E0000000E0000004B004500590057004F00520044005300450052005600450052000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>

afterwards it is like this:

Log Name:      Application
Source:        MSSQLSERVER
Date:          5/12/2013 12:40:55 AM
Event ID:      18454
Task Category: (4)
Level:         Information
Keywords:      Classic,Audit Success
User:          N/A
Computer:      Keywordserver
Description:
Login succeeded for user 'sa'. Connection: non-trusted. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="16384">18454</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0xa0000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-11T16:40:55.000Z" />
    <EventRecordID>204233208</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Keywordserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>sa</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>164800000A0000000E0000004B004500590057004F00520044005300450052005600450052000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>

I noticed that this occurs every 30 seconds.

I also tried to check the SQL Server 2005 database to test login for "sa". It seems good but I'm bothered with this information.

Thank you.
0
Comment
Question by:MediaBanc
1 Comment
 
LVL 23

Accepted Solution

by:
Racim BOUDJAKDJI earned 500 total points
ID: 39158399
If not used by some application, simply change the sa password and see what happens.
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

Nowadays, some of developer are too much worried about data. Who is using data, who is updating it etc. etc. Because, data is more costlier in term of money and information. So security of data is focusing concern in days. Lets' understand the Au…
Load balancing is the method of dividing the total amount of work performed by one computer between two or more computers. Its aim is to get more work done in the same amount of time, ensuring that all the users get served faster.
Familiarize people with the process of utilizing SQL Server functions from within Microsoft Access. Microsoft Access is a very powerful client/server development tool. One of the SQL Server objects that you can interact with from within Microsoft Ac…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now