Event ID: 17055

Hi all,
I havent been able to find any relevant information on this over the
internet so I thought I would post and see if you could make some sense of it.
I have been getting the error message below in my Application log on my
SQL2000 SP4 Server.
They appear in intervals of 3, 4, 10 and 13 seconds and fill up the log
Any ideas on what could be causing it?
Event Type: Information
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 17055
Date: 22/07/2006
Time: 09:37:30
User: N/A
Computer: HHSQL01
Description:
18456 :
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
Data:
0000: 18 48 00 00 0e 00 00 00 .H.....
0008: 08 00 00 00 48 00 48 00 ...H.H.
0010: 53 00 51 00 4c 00 30 00 S.Q.L.0.
0018: 31 00 00 00 07 00 00 00 1......
0020: 6d 00 61 00 73 00 74 00 m.a.s.t.
0028: 65 00 72 00 00 00 e.r...Adrian wrote:
> Hi all,
> I havent been able to find any relevant information on this over the
> internet so I thought I would post and see if you could make some sense of it.
> I have been getting the error message below in my Application log on my
> SQL2000 SP4 Server.
> They appear in intervals of 3, 4, 10 and 13 seconds and fill up the log
> Any ideas on what could be causing it?
> Event Type: Information
> Event Source: MSSQLSERVER
> Event Category: (4)
> Event ID: 17055
> Date: 22/07/2006
> Time: 09:37:30
> User: N/A
> Computer: HHSQL01
> Description:
> 18456 :
> Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
> Data:
> 0000: 18 48 00 00 0e 00 00 00 .H.....
> 0008: 08 00 00 00 48 00 48 00 ...H.H.
> 0010: 53 00 51 00 4c 00 30 00 S.Q.L.0.
> 0018: 31 00 00 00 07 00 00 00 1......
> 0020: 6d 00 61 00 73 00 74 00 m.a.s.t.
> 0028: 65 00 72 00 00 00 e.r...
Someone/thing is trying to login to your SQL instance using a "trusted
connection" or NT authentication, but is not currently authenticated.
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||> Someone/thing is trying to login to your SQL instance using a "trusted
> connection" or NT authentication, but is not currently authenticated.
Tracy,
Thanks, I feel like it must be a service or a "thing" rather than an actual
person. Due to the regular intervals of the logins and because they dont stop
24/7.
Do you know of any way I could check what is trying to log on? from where
sort of thing. We have over 20 Dbs on this server added to which im not a DB
admin so Im really a little lost.
Any ideas?|||This comes up under the Security log is it possible to trace it back to where
its trying to log in from? It seems to me that its running from the same
server, like its trying to access itself?
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 26/07/2006
Time: 09:40:04
User: NT AUTHORITY\SYSTEM
Computer: SQL01
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: admin405
Domain: SQL01
Logon Type: 2
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: SQL01|||Adrian wrote:
>> Someone/thing is trying to login to your SQL instance using a "trusted
>> connection" or NT authentication, but is not currently authenticated.
> Tracy,
> Thanks, I feel like it must be a service or a "thing" rather than an actual
> person. Due to the regular intervals of the logins and because they dont stop
> 24/7.
> Do you know of any way I could check what is trying to log on? from where
> sort of thing. We have over 20 Dbs on this server added to which im not a DB
> admin so Im really a little lost.
> Any ideas?
Do you have a backup agent of some kind running? Perhaps a monitoring
package?
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||Tracy,
Thanks :) I think thats what it is a service running under my name. My gut
feeling says its an ARCserve agent so I will look it that a little more.
I think it will be just a matter of going through each setting till I find
the culprite!
At least now I now what im looking for
Thanks again :)