Re: Login Failure

Turn on your SQL Server Profiler, make sure you select the hostname or
clientname as one of the columns in your trace and then start your trace on
your database.

Or you can enable C2 Auditing....
http://www.microsoft.com/technet/prodtechnol/sql/2000/maintain/sqlc2.mspx

thanks,

--
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/


"Justin Rich" <jrich523@xxxxxxxxxxxxxx> wrote in message
news:O6MY5eI7GHA.140@xxxxxxxxxxxxxxxxxxxxxxx
im getting a lot of login failures on admin accounts and i think it might
be an attempt from an unathurized machine. none fo the logs i look at tell
me about where the request is coming from (event logs/sql logs)

where should i be looking or how can i set the logs to monitor this stuff
better?

SQL2000SP3

Event Type: Information
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 17055
Date: 10/9/2006
Time: 2:23:08 PM
User: N/A
Computer: ROECLUSTER1
Description:
18456 :
Login failed for user 'admin'.





.

Relevant Pages

  • Re: Login Failure
    ... we'll see what that spits out for me. ... clientname as one of the columns in your trace and then start your trace ... tell me about where the request is coming from (event logs/sql logs) ...
    (microsoft.public.sqlserver.security)
  • Re: deadlock with 2.6.9
    ... this time not related to burning a dvd. ... Call Trace: ... logs to a stripe of two mirrors, ...
    (Linux-Kernel)
  • DBD::Pg 1.31 under mod_perl
    ... On Wed, 2003-11-19 at 18:01, Rudy Lippan wrote: ... and Apache/mod_perl suddently dies without any trace of error in ... the logs. ...
    (perl.dbi.users)
  • Re: Anyone know
    ... logs and the trace on posts, hiding is not an option. ...
    (rec.food.cooking)
  • Re: SQL Server Profiler
    ... You can monitor your firewall logs to get the IP addresses. ... >I ran SQL Server Profiler. ... From the trace, I found out ... >machines who are trying to hack into SQL Server? ...
    (microsoft.public.sqlserver.security)