Solved

High number of EventID 18456 from MSSQL$SQLSERVER on SBS 2008

Posted on 2016-08-08
5
53 Views
Last Modified: 2016-08-08
Hi Experts,

This SBS 2008 has a high number of EventID 18456 from MSSQL$SQLSERVER (about 3 every minute)

Login failed for user 'NT AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database. [CLIENT: <local machine>]

What could be the root cause of these errors?

Note:
1. This server is SQL 2008 R2 & SQL Server 2005 (Express?)
2. SQLSERVER has a CRM database on it which is managed by a 3d party
0
Comment
Question by:Alexandre Michel
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 49

Expert Comment

by:Vitor Montalvão
ID: 41747273
When the error started to appear?
What changed or was installed on that time?
0
 
LVL 4

Author Comment

by:Alexandre Michel
ID: 41747281
Vitor

The message appears every 20 seconds
I am not sure when it started, as event logs are overwritten after 4-5 days dues to the high number of entries
It could have been there for weeks or months... I just noticed today as I am spending a bit of time on this server
0
 
LVL 49

Accepted Solution

by:
Vitor Montalvão earned 500 total points
ID: 41747291
Some application or service is trying to connect to SQL Server using 'NT AUTHORITY\SYSTEM' account and that user doesn't have access to the requested database and that's why you're having those error log entries.

Try to find the application to solve it out.

NOTE: Many people install SQL Server with Local System account and that's good for hackers to try to break into SQL Server databases. Hopefully is not your case.
0
 
LVL 4

Author Closing Comment

by:Alexandre Michel
ID: 41748259
Thanks for our suggestion Vitor. I had to do quite a bit of digging to find which application was generating these log in requests, so marked as partial solution.
0
 
LVL 49

Expert Comment

by:Vitor Montalvão
ID: 41748294
That's the only way to find the application.
We from this side can't help you much with this task because we don't have access to your system.
Cheers
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Viewers will learn how to use the SELECT statement in SQL and will be exposed to the many uses the SELECT statement has.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question