Event ID: 17055

Duh, sorry the link you can look at are
http://search.microsoft.com/search/...s.aspx?View=en-
us&p=1&s=0&c=3&st=b&qu=Error%3a+3624%2c+Severity%3a+20%
2c+State%3a+1&na=30

>--Original Message--
>I have SQL Server 2000 (SP3) on the Windows Server 2000
(SP4). I received next message in the Event Log:
>Source: MSSQLSERVER
>Category: (2)
>ID: 17055
>18052
>Error: 3624, Severity: 20, State: 1
>What's is a problem?
>Michael S. Androsov
>EXPOCENTR
>.
>Adrian wrote:
> Hi all,
> I havent been able to find any relevant information on this over the
> internet so I thought I would post and see if you could make some sense of
it.
> I have been getting the error message below in my Application log on my
> SQL2000 SP4 Server.
> They appear in intervals of 3, 4, 10 and 13 seconds and fill up the log
> Any ideas on what could be causing it?
> Event Type: Information
> Event Source: MSSQLSERVER
> Event Category: (4)
> Event ID: 17055
> Date: 22/07/2006
> Time: 09:37:30
> User: N/A
> Computer: HHSQL01
> Description:
> 18456 :
> Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
> Data:
> 0000: 18 48 00 00 0e 00 00 00 .H.....
> 0008: 08 00 00 00 48 00 48 00 ...H.H.
> 0010: 53 00 51 00 4c 00 30 00 S.Q.L.0.
> 0018: 31 00 00 00 07 00 00 00 1......
> 0020: 6d 00 61 00 73 00 74 00 m.a.s.t.
> 0028: 65 00 72 00 00 00 e.r...
Someone/thing is trying to login to your SQL instance using a "trusted
connection" or NT authentication, but is not currently authenticated.
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||> Someone/thing is trying to login to your SQL instance using a "trusted
> connection" or NT authentication, but is not currently authenticated.
Tracy,
Thanks, I feel like it must be a service or a "thing" rather than an actual
person. Due to the regular intervals of the logins and because they dont sto
p
24/7.
Do you know of any way I could check what is trying to log on? from where
sort of thing. We have over 20 Dbs on this server added to which im not a DB
admin so Im really a little lost.
Any ideas?|||This comes up under the Security log is it possible to trace it back to wher
e
its trying to log in from? It seems to me that its running from the same
server, like its trying to access itself?
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 26/07/2006
Time: 09:40:04
User: NT AUTHORITY\SYSTEM
Computer: SQL01
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: admin405
Domain: SQL01
Logon Type: 2
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAG
E_V1_0
Workstation Name: SQL01|||Adrian wrote:
> Tracy,
> Thanks, I feel like it must be a service or a "thing" rather than an actua
l
> person. Due to the regular intervals of the logins and because they dont s
top
> 24/7.
> Do you know of any way I could check what is trying to log on? from where
> sort of thing. We have over 20 Dbs on this server added to which im not a
DB
> admin so Im really a little lost.
> Any ideas?
Do you have a backup agent of some kind running? Perhaps a monitoring
package?
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||Tracy,
Thanks I think thats what it is a service running under my name. My gut
feeling says its an ARCserve agent so I will look it that a little more.
I think it will be just a matter of going through each setting till I find
the culprite!
At least now I now what im looking for
Thanks again