SQL Server Performance Forum – Threads Archive

SQL Express

Hi Guys,
i have been getting these messages since couple of days:
Event Type: Failure Audit
Event Source: MSSQL$SQLEXPRESS
Event Category: (4)
Event ID: 18456
Date: 8/21/2006
Time: 5:45:01 PM
User: N/A
Computer: NS1
Description:
Login failed for user ‘sa’. [CLIENT: 24.219.104.30] It seems to be a soft of attack/spoofing.. could be a worm, not sure Anyboby has a clue AKTHAR

---

These events are because of audit settings in sql server, To stop these event logs: 1. Open SQL EM, select the server name from registered, right click and go to security under properties.
2. select ‘Audit Level’ as NONE. Read ‘Login Auditing’ from :http://www.databasejournal.com/features/mssql/article.php/3399241 for more details. Deepak Kumar
MVP, MCDBA – SQL Server Disclaimer: This post is provided as is with no rights & warranty for accuracy, for the sake of knowledge sharing only.

---

Thanks deepak, but what i want to know is whether this is an attack or not? and is there a way to prevent those from happening?
AKTHAR

---

Run the sql profiler for capturing security events.. identify the source computer/client machine which is causing most "loging failed" events… Have your IT team to scan the computer/client machine thoroughly. Deepak Kumar
MVP, MCDBA – SQL Server Disclaimer: This post is provided as is with no rights & warranty for accuracy, for the sake of knowledge sharing only.

---

Thanks AKTHAR

---

]]>