How do I trace SQL Server Failure Audit events?
Posted
by Tim Perry
on Stack Overflow
See other posts from Stack Overflow
or by Tim Perry
Published on 2010-03-06T00:23:18Z
Indexed on
2010/04/03
10:23 UTC
Read the original article
Hit count: 212
Filed under:
sql-server
I recently took over management of a Windows 2003 server. The application log is being filled up with messages like these:
Event Type: Failure Audit
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 18456
Date: 3/5/2010
Time: 4:00:30 PM
User: N/A
Computer: FAIROAKS1
Description:
Login failed for user 'administrator'. [CLIENT: <local machine>]
Data:
0000: 18 48 00 00 0e 00 00 00 .H......
0008: 0a 00 00 00 46 00 41 00 ....F.A.
0010: 49 00 52 00 4f 00 41 00 I.R.O.A.
0018: 4b 00 53 00 31 00 00 00 K.S.1...
0020: 07 00 00 00 6d 00 61 00 ....m.a.
0028: 73 00 74 00 65 00 72 00 s.t.e.r.
0030: 00 00 ..
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I'd like to figure out what program is causing these. Is there a way to trace and find out which process is causing these errors?
© Stack Overflow or respective owner
