MediaBanc
asked on
MS SQL Server 2005 Event ID: 18456 / Event ID: 18454
Hi Experts!
I got this information inside Event Viewer -> Windows Logs -> Application
afterwards it is like this:
I noticed that this occurs every 30 seconds.
I also tried to check the SQL Server 2005 database to test login for "sa". It seems good but I'm bothered with this information.
Thank you.
I got this information inside Event Viewer -> Windows Logs -> Application
Log Name: Application
Source: MSSQLSERVER
Date: 5/12/2013 12:41:22 AM
Event ID: 18456
Task Category: (4)
Level: Information
Keywords: Classic,Audit Failure
User: N/A
Computer: Keywordserver
Description:
Login failed for user 'sa'. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSSQLSERVER" />
<EventID Qualifiers="49152">18456</EventID>
<Level>0</Level>
<Task>4</Task>
<Keywords>0x90000000000000</Keywords >
<TimeCreated SystemTime="2013-05-11T16:41:22.000Z " />
<EventRecordID>204233209</EventRecor dID>
<Channel>Application</Channel>
<Computer>Keywordserver</Computer>
<Security />
</System>
<EventData>
<Data>sa</Data>
<Data> [CLIENT: <local machine>]</Data>
<Binary>184800000E0000000E0000004B00 4500590057 004F005200 4400530045 0052005600 4500520000 0007000000 6D00610073 0074006500 72000000</ Binary>
</EventData>
</Event>
afterwards it is like this:
Log Name: Application
Source: MSSQLSERVER
Date: 5/12/2013 12:40:55 AM
Event ID: 18454
Task Category: (4)
Level: Information
Keywords: Classic,Audit Success
User: N/A
Computer: Keywordserver
Description:
Login succeeded for user 'sa'. Connection: non-trusted. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSSQLSERVER" />
<EventID Qualifiers="16384">18454</EventID>
<Level>0</Level>
<Task>4</Task>
<Keywords>0xa0000000000000</Keywords >
<TimeCreated SystemTime="2013-05-11T16:40:55.000Z " />
<EventRecordID>204233208</EventRecor dID>
<Channel>Application</Channel>
<Computer>Keywordserver</Computer>
<Security />
</System>
<EventData>
<Data>sa</Data>
<Data> [CLIENT: <local machine>]</Data>
<Binary>164800000A0000000E0000004B00 4500590057 004F005200 4400530045 0052005600 4500520000 0007000000 6D00610073 0074006500 72000000</ Binary>
</EventData>
</Event>
I noticed that this occurs every 30 seconds.
I also tried to check the SQL Server 2005 database to test login for "sa". It seems good but I'm bothered with this information.
Thank you.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.