[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

MS SQL Server 2005 Event ID: 18456 / Event ID: 18454

Posted on 2013-05-11
1
Medium Priority
?
2,082 Views
Last Modified: 2013-06-13
Hi Experts!

I got this information inside Event Viewer -> Windows Logs -> Application

Log Name:      Application
Source:        MSSQLSERVER
Date:          5/12/2013 12:41:22 AM
Event ID:      18456
Task Category: (4)
Level:         Information
Keywords:      Classic,Audit Failure
User:          N/A
Computer:      Keywordserver
Description:
Login failed for user 'sa'. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="49152">18456</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0x90000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-11T16:41:22.000Z" />
    <EventRecordID>204233209</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Keywordserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>sa</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>184800000E0000000E0000004B004500590057004F00520044005300450052005600450052000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>

afterwards it is like this:

Log Name:      Application
Source:        MSSQLSERVER
Date:          5/12/2013 12:40:55 AM
Event ID:      18454
Task Category: (4)
Level:         Information
Keywords:      Classic,Audit Success
User:          N/A
Computer:      Keywordserver
Description:
Login succeeded for user 'sa'. Connection: non-trusted. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="16384">18454</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0xa0000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-11T16:40:55.000Z" />
    <EventRecordID>204233208</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Keywordserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>sa</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>164800000A0000000E0000004B004500590057004F00520044005300450052005600450052000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>

I noticed that this occurs every 30 seconds.

I also tried to check the SQL Server 2005 database to test login for "sa". It seems good but I'm bothered with this information.

Thank you.
0
Comment
Question by:MediaBanc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 23

Accepted Solution

by:
Racim BOUDJAKDJI earned 1500 total points
ID: 39158399
If not used by some application, simply change the sa password and see what happens.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ever wondered why sometimes your SQL Server is slow or unresponsive with connections spiking up but by the time you go in, all is well? The following article will show you how to install and configure a SQL job that will send you email alerts includ…
In this article we will learn how to fix  “Cannot install SQL Server 2014 Service Pack 2: Unable to install windows installer msi file” error ?
Familiarize people with the process of retrieving data from SQL Server using an Access pass-thru query. Microsoft Access is a very powerful client/server development tool. One of the ways that you can retrieve data from a SQL Server is by using a pa…
Via a live example, show how to extract information from SQL Server on Database, Connection and Server properties

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question