Solved

MS SQL Server 2005 Event ID: 18456 / Event ID: 18454

Posted on 2013-05-11
1
1,778 Views
Last Modified: 2013-06-13
Hi Experts!

I got this information inside Event Viewer -> Windows Logs -> Application

Log Name:      Application
Source:        MSSQLSERVER
Date:          5/12/2013 12:41:22 AM
Event ID:      18456
Task Category: (4)
Level:         Information
Keywords:      Classic,Audit Failure
User:          N/A
Computer:      Keywordserver
Description:
Login failed for user 'sa'. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="49152">18456</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0x90000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-11T16:41:22.000Z" />
    <EventRecordID>204233209</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Keywordserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>sa</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>184800000E0000000E0000004B004500590057004F00520044005300450052005600450052000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>

afterwards it is like this:

Log Name:      Application
Source:        MSSQLSERVER
Date:          5/12/2013 12:40:55 AM
Event ID:      18454
Task Category: (4)
Level:         Information
Keywords:      Classic,Audit Success
User:          N/A
Computer:      Keywordserver
Description:
Login succeeded for user 'sa'. Connection: non-trusted. [CLIENT: <local machine>]
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSSQLSERVER" />
    <EventID Qualifiers="16384">18454</EventID>
    <Level>0</Level>
    <Task>4</Task>
    <Keywords>0xa0000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-11T16:40:55.000Z" />
    <EventRecordID>204233208</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Keywordserver</Computer>
    <Security />
  </System>
  <EventData>
    <Data>sa</Data>
    <Data> [CLIENT: &lt;local machine&gt;]</Data>
    <Binary>164800000A0000000E0000004B004500590057004F00520044005300450052005600450052000000070000006D00610073007400650072000000</Binary>
  </EventData>
</Event>

I noticed that this occurs every 30 seconds.

I also tried to check the SQL Server 2005 database to test login for "sa". It seems good but I'm bothered with this information.

Thank you.
0
Comment
Question by:MediaBanc
1 Comment
 
LVL 23

Accepted Solution

by:
Racim BOUDJAKDJI earned 500 total points
ID: 39158399
If not used by some application, simply change the sa password and see what happens.
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction SQL Server Integration Services can read XML files, that’s known by every BI developer.  (If you didn’t, don’t worry, I’m aiming this article at newcomers as well.) But how far can you go?  When does the XML Source component become …
Ever needed a SQL 2008 Database replicated/mirrored/log shipped on another server but you can't take the downtime inflicted by initial snapshot or disconnect while T-logs are restored or mirror applied? You can use SQL Server Initialize from Backup…
Via a live example combined with referencing Books Online, show some of the information that can be extracted from the Catalog Views in SQL Server.
This videos aims to give the viewer a basic demonstration of how a user can query current session information by using the SYS_CONTEXT function

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now