July 15, 2004 at 9:07 am
Hello,
MSSQL 7 w/SP2; Win NT
The 'sa' account was changed about 2 months ago. The SQLServerAgent account is not operating uder 'sa'. There are no jobs owned by 'sa'. Backups are successful and 10 GB disk remains. The error messages began just 2 days ago, and the repeat frequency has increased from every hour to every 1-2min. Can anyone shed some light on the following:
<for each occurance> ...
The MSSQL errors logs:
* <date> <source=logon> Login failed for user 'sa'.
The opeartor receives the following 2 emails:
* SQL Server Alert System: 'Demo: Sev. 24 Errors' occurred on "\\servername"
DESCRIPTION: 18456
Login failed for user 'sa'.
* SQL Server Alert System: 'Demo: Sev. 22 Errors' occurred on \\servername
DESCRIPTION: 18456
Login failed for user 'sa'.
Windows Event Viewer:
18456 : Login failed for user 'sa'.
Many thanks. Jeff
July 15, 2004 at 10:51 am
Either one of two things is happening:
1. You still have a job or an application running that is attempting to login using the sa account, and fails.
2. Someone is trying to hack you sa account.
I would just run profiler and find out where these requests are coming from?
A.J.
DBA with an attitude
July 15, 2004 at 12:40 pm
Turned out to be #2 ... we used a network IP sniffer to block. Thanks for the advice.
Many thanks. Jeff
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply