Re: Where did the connections come from?

Thanks much. Actually we've seen varioius login failures. Null is just one
of them. It would be great for the SQL logs to include the information like
IP addresses, was it a connection from a web application (e.g. ASP.NET) or
ODBC or brute force logon on the database console.

Bing

"Russell Fields" wrote:

Ah, in that case perhaps this is your problem:
http://support.microsoft.com/kb/307002

Harish Ranganathan may be able to help with his blog comments:
http://harishmvp.blogspot.com/2005/05/you-may-receive-error-login-failed-for.html
http://harishmvp.blogspot.com/2005/05/you-may-receive-error-login-failed-for_25.html

RLF

"bing" <bing@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A57DD3B7-3A03-45A5-B0A8-3499CDE2B58A@xxxxxxxxxxxxxxxx
Thanks much for the reply. Good to know. But why I don't see any
connecting
IP or hostname? In EM, under Management->SQL Server Logs, when I click a
log
entry, here is all the information I can see.

SQL Server Error Log message
Source: logon
Date: 2007-04-11 09:49:40.22
Message: Login failed for user '(null)'. Reason: Not associated with a
trusted SQL server connection.

I'm not clear if SQL 2000 has any log level settings anywhere.

Bing

"Russell Fields" wrote:

The login failure entries should have the IP address of the machine from
which the login was attempted. Look up that IP address on your domain
and
see whose machine it is.

From the command prompt, this may help:
nbtstat -a the.ip.addr.ess

RLF
"bing" <bing@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:72B6EC6E-DFBE-4A5D-ADA4-480FCCC95B05@xxxxxxxxxxxxxxxx
Hi,

We use SQL 2000 on Windows 2003. In Enterprise Manager, when I looked
through the SQL server logs, I found a lot login failures. But how can
I
know where those login failure connections came from?

Thanks much in advance for any insight.

Bing








.

Relevant Pages

  • Re: Does NTBackup backup SQL Express?
    ... In which case I assume the logs do NOT get flushed so this is not an option ... as I know enough that the logs must be flushed during every full backup. ... and the SBS server I regularly use runs MySQL not SQL ... I've always scripted my SQL Server backups separatly. ...
    (microsoft.public.windows.server.sbs)
  • Re: Migrating logs to SAN
    ... In SQL 2005 this might work as long as the same drive structure is observed, and you have the same database IDs. ... We'd like migrate the logs from the local ... Stop the SQL server ... Assign the SAN device the drive letter previously claimed by the local ...
    (microsoft.public.sqlserver.replication)
  • Missing DLL during re-installation
    ... The installation appeared to complete successfully and I ... SQL Server Setup failed to execute a command for server configuration. ... Refer to the server error logs and Setup ...
    (microsoft.public.sqlserver.setup)
  • Re: Are multiple transaction logs used concurrently or sequentially?
    ... The way the SQL Logs work is sequential... ... I support the Professional Association of SQL Server and it's community of SQL Server professionals. ... > It'd be nice to have redundant transaction logs, maybe even one on a> mapped drive, but I read in one post here that SQL Server considers> all transaction logs to be one big log file. ...
    (microsoft.public.sqlserver.server)
  • Re: testing vulnerable web application.
    ... You should be able to just open up your logs and look for things that are out of the ordinary. ... Keep your database and all but double check it to make sure there really aren't accounts and what not that should not be there. ... We assumed the attacker was using some sort of SQL injection to alter the DB records or possibly he can craft a SQL query in a way that will create an admin account to use to simply log in and alter the records and then delete his username...NO rogue admin accounts have ever been found. ... You have an option to go with a managed service or an enterprise software. ...
    (Pen-Test)