Friday, March 9, 2012
method to get more info for failed login
We are currently tracking SQL Server login failures. But the SQL Server
error log only give infomation about which login has been attempted failed.
Is there a way to tell more info about this failed login, like from which
mechine the failed login came?
Thanks.
Hong Wang wrote:
> Hi,
> We are currently tracking SQL Server login failures. But the SQL
> Server error log only give infomation about which login has been
> attempted failed. Is there a way to tell more info about this failed
> login, like from which mechine the failed login came?
> Thanks.
Yes, you can set up a server-side trace to watch for the Audit Login
Failed event in the Security Audit category. The easiest way to do this
is define the server-side trace from Profiler and then have profiler
save the script for you. use the script in a stored procedure and set
the procedure to auto-start (sp_procoption) when the server starts. All
information is written to a local file onthe server, which is locked by
the trace. You can write a purge procedure that stops the trace and
merges the data from the flat file into table or just copies the file
and then restarts the trace. You have a lot of options here, but the
server-side trace is the way to go.
Use the following columns when defining the trace:
DatabaseID
StartTime
Error
ServerName
Success
TextData
ApplicationName
LoginName
ClientProcessID
SPID
Success will always be 0 for this event. HostName is not passed.
David Gugick
Imceda Software
www.imceda.com
method to get more info for failed login
We are currently tracking SQL Server login failures. But the SQL Server
error log only give infomation about which login has been attempted failed.
Is there a way to tell more info about this failed login, like from which
mechine the failed login came?
Thanks.Hong Wang wrote:
> Hi,
> We are currently tracking SQL Server login failures. But the SQL
> Server error log only give infomation about which login has been
> attempted failed. Is there a way to tell more info about this failed
> login, like from which mechine the failed login came?
> Thanks.
Yes, you can set up a server-side trace to watch for the Audit Login
Failed event in the Security Audit category. The easiest way to do this
is define the server-side trace from Profiler and then have profiler
save the script for you. use the script in a stored procedure and set
the procedure to auto-start (sp_procoption) when the server starts. All
information is written to a local file onthe server, which is locked by
the trace. You can write a purge procedure that stops the trace and
merges the data from the flat file into table or just copies the file
and then restarts the trace. You have a lot of options here, but the
server-side trace is the way to go.
Use the following columns when defining the trace:
DatabaseID
StartTime
Error
ServerName
Success
TextData
ApplicationName
LoginName
ClientProcessID
SPID
Success will always be 0 for this event. HostName is not passed.
David Gugick
Imceda Software
www.imceda.com
method to get more info for failed login
We are currently tracking SQL Server login failures. But the SQL Server
error log only give infomation about which login has been attempted failed.
Is there a way to tell more info about this failed login, like from which
mechine the failed login came?
Thanks.Hong Wang wrote:
> Hi,
> We are currently tracking SQL Server login failures. But the SQL
> Server error log only give infomation about which login has been
> attempted failed. Is there a way to tell more info about this failed
> login, like from which mechine the failed login came?
> Thanks.
Yes, you can set up a server-side trace to watch for the Audit Login
Failed event in the Security Audit category. The easiest way to do this
is define the server-side trace from Profiler and then have profiler
save the script for you. use the script in a stored procedure and set
the procedure to auto-start (sp_procoption) when the server starts. All
information is written to a local file onthe server, which is locked by
the trace. You can write a purge procedure that stops the trace and
merges the data from the flat file into table or just copies the file
and then restarts the trace. You have a lot of options here, but the
server-side trace is the way to go.
Use the following columns when defining the trace:
DatabaseID
StartTime
Error
ServerName
Success
TextData
ApplicationName
LoginName
ClientProcessID
SPID
Success will always be 0 for this event. HostName is not passed.
David Gugick
Imceda Software
www.imceda.com
Wednesday, March 7, 2012
Metabase Log
Database file is 18.7MB. How do I clear out the Metabase Log File?
Check the recovery model of the database. If it is in full mode, the
database log file will keep growing, unless you take periodic transaction
log backups.
If you don't need transaction log backups, but simply want to backup the
database once a day or so, switch the database to simple recovery mode.
This can be done from the database properties dialog box in Enterprise
Manager.
HTH,
Vyas, MVP (SQL Server)
SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
"KMD" <KMD@.discussions.microsoft.com> wrote in message
news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
Database file is 18.7MB. How do I clear out the Metabase Log File?
|||My backup strategy is set to Simple for quite some time now. How can I
regain the space that is used in the Metabase Log, it is 21GIG. To backup
the Transaction Log is greyed out, is this because the recovery model is set
to Simple. Any ideas to regain this space.
"Narayana Vyas Kondreddi" wrote:
> Check the recovery model of the database. If it is in full mode, the
> database log file will keep growing, unless you take periodic transaction
> log backups.
> If you don't need transaction log backups, but simply want to backup the
> database once a day or so, switch the database to simple recovery mode.
> This can be done from the database properties dialog box in Enterprise
> Manager.
> --
> HTH,
> Vyas, MVP (SQL Server)
> SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
>
> "KMD" <KMD@.discussions.microsoft.com> wrote in message
> news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
> We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
> Database file is 18.7MB. How do I clear out the Metabase Log File?
>
>
|||Try shrinking the file (DBCC SHRINKFILE).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"KMD" <KMD@.discussions.microsoft.com> wrote in message
news:06A1E21B-0CD9-49E7-A93B-6E50D104D8BC@.microsoft.com...[vbcol=seagreen]
> My backup strategy is set to Simple for quite some time now. How can I
> regain the space that is used in the Metabase Log, it is 21GIG. To backup
> the Transaction Log is greyed out, is this because the recovery model is set
> to Simple. Any ideas to regain this space.
> "Narayana Vyas Kondreddi" wrote:
Metabase Log
Database file is 18.7MB. How do I clear out the Metabase Log File?Check the recovery model of the database. If it is in full mode, the
database log file will keep growing, unless you take periodic transaction
log backups.
If you don't need transaction log backups, but simply want to backup the
database once a day or so, switch the database to simple recovery mode.
This can be done from the database properties dialog box in Enterprise
Manager.
--
HTH,
Vyas, MVP (SQL Server)
SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
"KMD" <KMD@.discussions.microsoft.com> wrote in message
news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
Database file is 18.7MB. How do I clear out the Metabase Log File?|||My backup strategy is set to Simple for quite some time now. How can I
regain the space that is used in the Metabase Log, it is 21GIG. To backup
the Transaction Log is greyed out, is this because the recovery model is set
to Simple. Any ideas to regain this space.
"Narayana Vyas Kondreddi" wrote:
> Check the recovery model of the database. If it is in full mode, the
> database log file will keep growing, unless you take periodic transaction
> log backups.
> If you don't need transaction log backups, but simply want to backup the
> database once a day or so, switch the database to simple recovery mode.
> This can be done from the database properties dialog box in Enterprise
> Manager.
> --
> HTH,
> Vyas, MVP (SQL Server)
> SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
>
> "KMD" <KMD@.discussions.microsoft.com> wrote in message
> news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
> We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
> Database file is 18.7MB. How do I clear out the Metabase Log File?
>
>|||Try shrinking the file (DBCC SHRINKFILE).
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"KMD" <KMD@.discussions.microsoft.com> wrote in message
news:06A1E21B-0CD9-49E7-A93B-6E50D104D8BC@.microsoft.com...
> My backup strategy is set to Simple for quite some time now. How can I
> regain the space that is used in the Metabase Log, it is 21GIG. To backup
> the Transaction Log is greyed out, is this because the recovery model is set
> to Simple. Any ideas to regain this space.
> "Narayana Vyas Kondreddi" wrote:
>> Check the recovery model of the database. If it is in full mode, the
>> database log file will keep growing, unless you take periodic transaction
>> log backups.
>> If you don't need transaction log backups, but simply want to backup the
>> database once a day or so, switch the database to simple recovery mode.
>> This can be done from the database properties dialog box in Enterprise
>> Manager.
>> --
>> HTH,
>> Vyas, MVP (SQL Server)
>> SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
>>
>> "KMD" <KMD@.discussions.microsoft.com> wrote in message
>> news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
>> We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
>> Database file is 18.7MB. How do I clear out the Metabase Log File?
>>
Metabase Log
Database file is 18.7MB. How do I clear out the Metabase Log File?Check the recovery model of the database. If it is in full mode, the
database log file will keep growing, unless you take periodic transaction
log backups.
If you don't need transaction log backups, but simply want to backup the
database once a day or so, switch the database to simple recovery mode.
This can be done from the database properties dialog box in Enterprise
Manager.
--
HTH,
Vyas, MVP (SQL Server)
SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
"KMD" <KMD@.discussions.microsoft.com> wrote in message
news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
Database file is 18.7MB. How do I clear out the Metabase Log File?|||My backup strategy is set to Simple for quite some time now. How can I
regain the space that is used in the Metabase Log, it is 21GIG. To backup
the Transaction Log is greyed out, is this because the recovery model is set
to Simple. Any ideas to regain this space.
"Narayana Vyas Kondreddi" wrote:
> Check the recovery model of the database. If it is in full mode, the
> database log file will keep growing, unless you take periodic transaction
> log backups.
> If you don't need transaction log backups, but simply want to backup the
> database once a day or so, switch the database to simple recovery mode.
> This can be done from the database properties dialog box in Enterprise
> Manager.
> --
> HTH,
> Vyas, MVP (SQL Server)
> SQL Server Articles and Code Samples @. http://vyaskn.tripod.com/
>
> "KMD" <KMD@.discussions.microsoft.com> wrote in message
> news:9D0CA478-2FAA-4AEA-97B7-C4608637D1F8@.microsoft.com...
> We are using MSCRM and my SQL Metabase Log file is 21.3GB and my Metabase
> Database file is 18.7MB. How do I clear out the Metabase Log File?
>
>|||Try shrinking the file (DBCC SHRINKFILE).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"KMD" <KMD@.discussions.microsoft.com> wrote in message
news:06A1E21B-0CD9-49E7-A93B-6E50D104D8BC@.microsoft.com...[vbcol=seagreen]
> My backup strategy is set to Simple for quite some time now. How can I
> regain the space that is used in the Metabase Log, it is 21GIG. To backup
> the Transaction Log is greyed out, is this because the recovery model is s
et
> to Simple. Any ideas to regain this space.
> "Narayana Vyas Kondreddi" wrote:
>
Saturday, February 25, 2012
Message: Cannot use Large Page Extensions
I have noticed following messaeg in SQL Server 2005 error log:'Cannot
use Large Page Extensions: lock memory privilege was not granted.' Server
is Active/Passive 64-bit SQL Server cluster with 28GB or RAM.
Can anyone explaing what this messaeg means?
Thanks,
IgorDid you give the service account for the SQL Server service "Lock Pages in m
emory" user rights.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"imarchenko" <igormarchenko@.hotmail.com> wrote in message
news:umi2vLIRGHA.4952@.TK2MSFTNGP09.phx.gbl...
> Hello!
> I have noticed following messaeg in SQL Server 2005 error log:'Cannot u
se Large Page
> Extensions: lock memory privilege was not granted.' Server is Active/Pass
ive 64-bit SQL Server
> cluster with 28GB or RAM.
> Can anyone explaing what this messaeg means?
> Thanks,
> Igor
>|||Tibor,
Is this a good idea to do this on 64-bit vesion of SQL Server 2005? BOL
says: 'Though not required, Microsoft recommends locking pages in memory
when using 64-bit operating systems'. Will my SQL Server benefit from having
this option configured?
Thanks,
Igor
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:eBUVHQIRGHA.4300@.TK2MSFTNGP14.phx.gbl...
> Did you give the service account for the SQL Server service "Lock Pages in
> memory" user rights.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "imarchenko" <igormarchenko@.hotmail.com> wrote in message
> news:umi2vLIRGHA.4952@.TK2MSFTNGP09.phx.gbl...
>|||Slava Oks has several articles on memory management on his blog. As I recall
, he recommends locking
pages on 64 bit as well. Check it out at http://blogs.msdn.com/slavao/
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"imarchenko" <igormarchenko@.hotmail.com> wrote in message
news:O0LuocIRGHA.4452@.TK2MSFTNGP12.phx.gbl...
> Tibor,
> Is this a good idea to do this on 64-bit vesion of SQL Server 2005? BOL
says: 'Though not
> required, Microsoft recommends locking pages in memory when using 64-bit o
perating systems'. Will
> my SQL Server benefit from having this option configured?
>
> Thanks,
> Igor
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n message
> news:eBUVHQIRGHA.4300@.TK2MSFTNGP14.phx.gbl...
>
Message: Cannot use Large Page Extensions
I have noticed following messaeg in SQL Server 2005 error log:'Cannot
use Large Page Extensions: lock memory privilege was not granted.' Server
is Active/Passive 64-bit SQL Server cluster with 28GB or RAM.
Can anyone explaing what this messaeg means?
Thanks,
IgorDid you give the service account for the SQL Server service "Lock Pages in memory" user rights.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"imarchenko" <igormarchenko@.hotmail.com> wrote in message
news:umi2vLIRGHA.4952@.TK2MSFTNGP09.phx.gbl...
> Hello!
> I have noticed following messaeg in SQL Server 2005 error log:'Cannot use Large Page
> Extensions: lock memory privilege was not granted.' Server is Active/Passive 64-bit SQL Server
> cluster with 28GB or RAM.
> Can anyone explaing what this messaeg means?
> Thanks,
> Igor
>|||Tibor,
Is this a good idea to do this on 64-bit vesion of SQL Server 2005? BOL
says: 'Though not required, Microsoft recommends locking pages in memory
when using 64-bit operating systems'. Will my SQL Server benefit from having
this option configured?
Thanks,
Igor
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:eBUVHQIRGHA.4300@.TK2MSFTNGP14.phx.gbl...
> Did you give the service account for the SQL Server service "Lock Pages in
> memory" user rights.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> Blog: http://solidqualitylearning.com/blogs/tibor/
>
> "imarchenko" <igormarchenko@.hotmail.com> wrote in message
> news:umi2vLIRGHA.4952@.TK2MSFTNGP09.phx.gbl...
>> Hello!
>> I have noticed following messaeg in SQL Server 2005 error log:'Cannot
>> use Large Page Extensions: lock memory privilege was not granted.'
>> Server is Active/Passive 64-bit SQL Server cluster with 28GB or RAM.
>> Can anyone explaing what this messaeg means?
>> Thanks,
>> Igor
>|||Slava Oks has several articles on memory management on his blog. As I recall, he recommends locking
pages on 64 bit as well. Check it out at http://blogs.msdn.com/slavao/
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"imarchenko" <igormarchenko@.hotmail.com> wrote in message
news:O0LuocIRGHA.4452@.TK2MSFTNGP12.phx.gbl...
> Tibor,
> Is this a good idea to do this on 64-bit vesion of SQL Server 2005? BOL says: 'Though not
> required, Microsoft recommends locking pages in memory when using 64-bit operating systems'. Will
> my SQL Server benefit from having this option configured?
>
> Thanks,
> Igor
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in message
> news:eBUVHQIRGHA.4300@.TK2MSFTNGP14.phx.gbl...
>> Did you give the service account for the SQL Server service "Lock Pages in memory" user rights.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> Blog: http://solidqualitylearning.com/blogs/tibor/
>>
>> "imarchenko" <igormarchenko@.hotmail.com> wrote in message
>> news:umi2vLIRGHA.4952@.TK2MSFTNGP09.phx.gbl...
>> Hello!
>> I have noticed following messaeg in SQL Server 2005 error log:'Cannot use Large Page
>> Extensions: lock memory privilege was not granted.' Server is Active/Passive 64-bit SQL Server
>> cluster with 28GB or RAM.
>> Can anyone explaing what this messaeg means?
>> Thanks,
>> Igor
>>
>
Message pane in QA
Is it possible to get the text from the Message tab in QA written to a log
in some way? We are running a lot of scripts to convert and later merge 2 of
our databases, and it would be helpful if I could get the results that are
written to the message tab directly into a logfile instead of having to
manually cut and paste it into a document.
Regards
SteenNot without executing to file, which probably isn't what you are looking for. Run a Profiler trace
with appropriate events, columns and filters instead.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steen Persson" <SPE@.REMOVEdatea.dk> wrote in message news:eimZkG0ZFHA.2420@.TK2MSFTNGP12.phx.gbl...
> Hi
> Is it possible to get the text from the Message tab in QA written to a log in some way? We are
> running a lot of scripts to convert and later merge 2 of our databases, and it would be helpful if
> I could get the results that are written to the message tab directly into a logfile instead of
> having to manually cut and paste it into a document.
> Regards
> Steen
>|||Hi
Have you thought about using osql?
John
"Steen Persson" <SPE@.REMOVEdatea.dk> wrote in message
news:eimZkG0ZFHA.2420@.TK2MSFTNGP12.phx.gbl...
> Hi
> Is it possible to get the text from the Message tab in QA written to a log
> in some way? We are running a lot of scripts to convert and later merge 2
> of our databases, and it would be helpful if I could get the results that
> are written to the message tab directly into a logfile instead of having
> to manually cut and paste it into a document.
> Regards
> Steen
>|||I would put the script in a file and use OSQL ie
osql -i c:\myfile.sql -o c:\myoutfile.txt -E
Wayne Snyder MCDBA, SQL Server MVP
Mariner, Charlotte, NC
(Please respond only to the newsgroup.)
I support the Professional Association for SQL Server ( PASS) and it's
community of SQL Professionals.
"Steen Persson" <SPE@.REMOVEdatea.dk> wrote in message
news:eimZkG0ZFHA.2420@.TK2MSFTNGP12.phx.gbl...
> Hi
> Is it possible to get the text from the Message tab in QA written to a log
> in some way? We are running a lot of scripts to convert and later merge 2
of
> our databases, and it would be helpful if I could get the results that are
> written to the message tab directly into a logfile instead of having to
> manually cut and paste it into a document.
> Regards
> Steen
>
Monday, February 20, 2012
message in sql server error log
20 sec? the instance is Standard SQL server 2000 with mixed security mode
and sql server service accout is domain admin member. The application that
use database is working fine but out error log fills up very fast. I will
appreciate any advise.
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> every
> 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> and sql server service accout is domain admin member. The application that
> use database is working fine but out error log fills up very fast. I will
> appreciate any advise.
Just a guess here, but that domain account will need to have local admin
permissions on your SQL Server.
In addition, you may need to set the Run As a Service permission, or Log On
as a Service.. Something like that. <shrug>
I'm sure others can expand on this.
Rick Sawtell
MCT, MCSD, MCDBA
|||Is this showing up in sql errorlog or system log ?
Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote computer
?
How did you set the service account user names ?
Have you thought about setting and audit (Remember SQL Can do C2), and
watching realtime with profiler ?
Is this computer a domain contoler and/r any FSMO Role
BTW: It is bad practice to run sql services with admin privilages
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> every
> 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> and sql server service accout is domain admin member. The application that
> use database is working fine but out error log fills up very fast. I will
> appreciate any advise.
|||"David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
news:ee1GqLtvFHA.3152@.TK2MSFTNGP12.phx.gbl...
> Is this showing up in sql errorlog or system log ?
> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
> computer ?
> How did you set the service account user names ?
> Have you thought about setting and audit (Remember SQL Can do C2), and
> watching realtime with profiler ?
> Is this computer a domain contoler and/r any FSMO Role
> BTW: It is bad practice to run sql services with admin privilages
>
Don't they need local admin rights? It's been a while since I've had to do
a setup like that.
Rick Sawtell
|||"David J. Cartwright" wrote:
> Is this showing up in sql errorlog or system log ?
<EM> In sql error log
> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote computer
> ?
<EM> DOMAIN\COMPUTER$ is for the remote computer.
> How did you set the service account user names ?
<EM> members of domain admin group
> Have you thought about setting and audit (Remember SQL Can do C2), and
> watching realtime with profiler ?
<EM> I did this the message appears when application account
DOMAIN\appaccount is login / logout to sql server. Its not a threat at all so
no sence to use C2
> Is this computer a domain contoler and/r any FSMO Role
<EM> no the computer thats tryng to log is standalone backup server
> BTW: It is bad practice to run sql services with admin privilages
<EM> we are in process of changing this
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
>
>
|||SQL Server only *needs access to its files (system files, and dta
files...usualy C:\Program Files\Microsoft SQL Server..." and its reqistry
keys...
to keep a machine more secure minimize the access that the service account
have
If the service is running with local admin rights...and the sql server is
hacked, then the whole system is comprimised (CmdExec)
"Rick Sawtell" <r_sawtell@.hotmail.com> wrote in message
news:O4X4EVtvFHA.1252@.TK2MSFTNGP09.phx.gbl...
> "David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
> news:ee1GqLtvFHA.3152@.TK2MSFTNGP12.phx.gbl...
> Don't they need local admin rights? It's been a while since I've had to
> do a setup like that.
> Rick Sawtell
>
|||Is the account 'appacccount' loging in from an application on this remote
computer?
The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is when
the computer domain account has gotten out of sync. But i dont know why this
would show up in the sql log...if this is the computer that the appaccount
acount is loging in from and they happen at same time...i would check make
sure that the computers account is in synce...ie thats its p/w has been
set/reset with the domain
did you mean server is a 'member' server or is it realy a 'standolone'
server...?
- David
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...[vbcol=seagreen]
>
> "David J. Cartwright" wrote:
> <EM> In sql error log
> <EM> DOMAIN\COMPUTER$ is for the remote computer.
> <EM> members of domain admin group
> <EM> I did this the message appears when application account
> DOMAIN\appaccount is login / logout to sql server. Its not a threat at all
> so
> no sence to use C2
> <EM> no the computer thats tryng to log is standalone backup server
> <EM> we are in process of changing this
|||thanks David,
please see my answers below
"David J. Cartwright" wrote:
> Is the account 'appacccount' loging in from an application on this remote
> computer?
<EM> yes ...exactly from the same server
> The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is when
> the computer domain account has gotten out of sync. But i dont know why this
> would show up in the sql log...if this is the computer that the appaccount
> acount is loging in from and they happen at same time...i would check make
> sure that the computers account is in synce...ie thats its p/w has been
> set/reset with the domain
<EM>How can I check computer account? pls advise
> did you mean server is a 'member' server or is it realy a 'standolone'
> server...?
>
<EM> its standalone server
> - David
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
>
>
|||O.K lemmi get this straight...the sql server is a 'standalone' server,
meaning that it is NOT a member of the domain, but it is using domain
accounts (more specificaly, a domain admin account) to run the services ?
also what kinda domain is this NT4/2000/2003 ? and what level is it running
at ? (this will help me answer the computer account prob)
http://support.microsoft.com/default...b;en-us;325850
http://support.microsoft.com/default...b;en-us;260575
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...[vbcol=seagreen]
> thanks David,
> please see my answers below
> "David J. Cartwright" wrote:
> <EM> yes ...exactly from the same server
> <EM>How can I check computer account? pls advise
> <EM> its standalone server
|||ok ...there is misunderstanding no not that kind of standalone server : ) its
just an application server obviously a domain member
and ...w2000 domain
"David J. Cartwright" wrote:
> O.K lemmi get this straight...the sql server is a 'standalone' server,
> meaning that it is NOT a member of the domain, but it is using domain
> accounts (more specificaly, a domain admin account) to run the services ?
> also what kinda domain is this NT4/2000/2003 ? and what level is it running
> at ? (this will help me answer the computer account prob)
> http://support.microsoft.com/default...b;en-us;325850
> http://support.microsoft.com/default...b;en-us;260575
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...
>
>
message in sql server error log
20 sec? the instance is Standard SQL server 2000 with mixed security mode
and sql server service accout is domain admin member. The application that
use database is working fine but out error log fills up very fast. I will
appreciate any advise."Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> every
> 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> and sql server service accout is domain admin member. The application that
> use database is working fine but out error log fills up very fast. I will
> appreciate any advise.
Just a guess here, but that domain account will need to have local admin
permissions on your SQL Server.
In addition, you may need to set the Run As a Service permission, or Log On
as a Service.. Something like that. <shrug>
I'm sure others can expand on this.
Rick Sawtell
MCT, MCSD, MCDBA|||Is this showing up in sql errorlog or system log ?
Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote computer
?
How did you set the service account user names ?
Have you thought about setting and audit (Remember SQL Can do C2), and
watching realtime with profiler ?
Is this computer a domain contoler and/r any FSMO Role
BTW: It is bad practice to run sql services with admin privilages
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> every
> 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> and sql server service accout is domain admin member. The application that
> use database is working fine but out error log fills up very fast. I will
> appreciate any advise.|||"David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
news:ee1GqLtvFHA.3152@.TK2MSFTNGP12.phx.gbl...
> Is this showing up in sql errorlog or system log ?
> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
> computer ?
> How did you set the service account user names ?
> Have you thought about setting and audit (Remember SQL Can do C2), and
> watching realtime with profiler ?
> Is this computer a domain contoler and/r any FSMO Role
> BTW: It is bad practice to run sql services with admin privilages
>
Don't they need local admin rights? It's been a while since I've had to do
a setup like that.
Rick Sawtell|||"David J. Cartwright" wrote:
> Is this showing up in sql errorlog or system log ?
<EM> In sql error log
> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote computer
> ?
<EM> DOMAIN\COMPUTER$ is for the remote computer.
> How did you set the service account user names ?
<EM> members of domain admin group
> Have you thought about setting and audit (Remember SQL Can do C2), and
> watching realtime with profiler ?
<EM> I did this the message appears when application account
DOMAIN\appaccount is login / logout to sql server. Its not a threat at all so
no sence to use C2
> Is this computer a domain contoler and/r any FSMO Role
<EM> no the computer thats tryng to log is standalone backup server
> BTW: It is bad practice to run sql services with admin privilages
<EM> we are in process of changing this
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> > What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> > every
> > 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> > and sql server service accout is domain admin member. The application that
> > use database is working fine but out error log fills up very fast. I will
> > appreciate any advise.
>
>|||SQL Server only *needs access to its files (system files, and dta
files...usualy C:\Program Files\Microsoft SQL Server..." and its reqistry
keys...
to keep a machine more secure minimize the access that the service account
have
If the service is running with local admin rights...and the sql server is
hacked, then the whole system is comprimised (CmdExec)
"Rick Sawtell" <r_sawtell@.hotmail.com> wrote in message
news:O4X4EVtvFHA.1252@.TK2MSFTNGP09.phx.gbl...
> "David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
> news:ee1GqLtvFHA.3152@.TK2MSFTNGP12.phx.gbl...
>> Is this showing up in sql errorlog or system log ?
>> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
>> computer ?
>> How did you set the service account user names ?
>> Have you thought about setting and audit (Remember SQL Can do C2), and
>> watching realtime with profiler ?
>> Is this computer a domain contoler and/r any FSMO Role
>> BTW: It is bad practice to run sql services with admin privilages
>>
> Don't they need local admin rights? It's been a while since I've had to
> do a setup like that.
> Rick Sawtell
>|||Is the account 'appacccount' loging in from an application on this remote
computer?
The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is when
the computer domain account has gotten out of sync. But i dont know why this
would show up in the sql log...if this is the computer that the appaccount
acount is loging in from and they happen at same time...i would check make
sure that the computers account is in synce...ie thats its p/w has been
set/reset with the domain
did you mean server is a 'member' server or is it realy a 'standolone'
server...?
- David
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
>
> "David J. Cartwright" wrote:
>> Is this showing up in sql errorlog or system log ?
> <EM> In sql error log
>> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
>> computer
>> ?
> <EM> DOMAIN\COMPUTER$ is for the remote computer.
>> How did you set the service account user names ?
> <EM> members of domain admin group
>> Have you thought about setting and audit (Remember SQL Can do C2), and
>> watching realtime with profiler ?
> <EM> I did this the message appears when application account
> DOMAIN\appaccount is login / logout to sql server. Its not a threat at all
> so
> no sence to use C2
>> Is this computer a domain contoler and/r any FSMO Role
> <EM> no the computer thats tryng to log is standalone backup server
>> BTW: It is bad practice to run sql services with admin privilages
> <EM> we are in process of changing this
>> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
>> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
>> > What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
>> > every
>> > 20 sec? the instance is Standard SQL server 2000 with mixed security
>> > mode
>> > and sql server service accout is domain admin member. The application
>> > that
>> > use database is working fine but out error log fills up very fast. I
>> > will
>> > appreciate any advise.
>>|||thanks David,
please see my answers below
"David J. Cartwright" wrote:
> Is the account 'appacccount' loging in from an application on this remote
> computer?
<EM> yes ...exactly from the same server
> The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is when
> the computer domain account has gotten out of sync. But i dont know why this
> would show up in the sql log...if this is the computer that the appaccount
> acount is loging in from and they happen at same time...i would check make
> sure that the computers account is in synce...ie thats its p/w has been
> set/reset with the domain
<EM>How can I check computer account? pls advise
> did you mean server is a 'member' server or is it realy a 'standolone'
> server...?
>
<EM> its standalone server
> - David
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
> >
> >
> > "David J. Cartwright" wrote:
> >
> >> Is this showing up in sql errorlog or system log ?
> > <EM> In sql error log
> >
> >> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
> >> computer
> >> ?
> > <EM> DOMAIN\COMPUTER$ is for the remote computer.
> >
> >> How did you set the service account user names ?
> > <EM> members of domain admin group
> >
> >> Have you thought about setting and audit (Remember SQL Can do C2), and
> >> watching realtime with profiler ?
> > <EM> I did this the message appears when application account
> > DOMAIN\appaccount is login / logout to sql server. Its not a threat at all
> > so
> > no sence to use C2
> >
> >> Is this computer a domain contoler and/r any FSMO Role
> > <EM> no the computer thats tryng to log is standalone backup server
> >
> >> BTW: It is bad practice to run sql services with admin privilages
> > <EM> we are in process of changing this
> >>
> >> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> >> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> >> > What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> >> > every
> >> > 20 sec? the instance is Standard SQL server 2000 with mixed security
> >> > mode
> >> > and sql server service accout is domain admin member. The application
> >> > that
> >> > use database is working fine but out error log fills up very fast. I
> >> > will
> >> > appreciate any advise.
> >>
> >>
> >>
>
>|||O.K lemmi get this straight...the sql server is a 'standalone' server,
meaning that it is NOT a member of the domain, but it is using domain
accounts (more specificaly, a domain admin account) to run the services '
also what kinda domain is this NT4/2000/2003 ? and what level is it running
at ? (this will help me answer the computer account prob)
---
http://support.microsoft.com/default.aspx?scid=kb;en-us;325850
http://support.microsoft.com/default.aspx?scid=kb;en-us;260575
---
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...
> thanks David,
> please see my answers below
> "David J. Cartwright" wrote:
>> Is the account 'appacccount' loging in from an application on this remote
>> computer?
> <EM> yes ...exactly from the same server
>> The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is
>> when
>> the computer domain account has gotten out of sync. But i dont know why
>> this
>> would show up in the sql log...if this is the computer that the
>> appaccount
>> acount is loging in from and they happen at same time...i would check
>> make
>> sure that the computers account is in synce...ie thats its p/w has been
>> set/reset with the domain
> <EM>How can I check computer account? pls advise
>> did you mean server is a 'member' server or is it realy a 'standolone'
>> server...?
> <EM> its standalone server
>> - David
>> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
>> news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
>> >
>> >
>> > "David J. Cartwright" wrote:
>> >
>> >> Is this showing up in sql errorlog or system log ?
>> > <EM> In sql error log
>> >
>> >> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
>> >> computer
>> >> ?
>> > <EM> DOMAIN\COMPUTER$ is for the remote computer.
>> >
>> >> How did you set the service account user names ?
>> > <EM> members of domain admin group
>> >
>> >> Have you thought about setting and audit (Remember SQL Can do C2), and
>> >> watching realtime with profiler ?
>> > <EM> I did this the message appears when application account
>> > DOMAIN\appaccount is login / logout to sql server. Its not a threat at
>> > all
>> > so
>> > no sence to use C2
>> >
>> >> Is this computer a domain contoler and/r any FSMO Role
>> > <EM> no the computer thats tryng to log is standalone backup server
>> >
>> >> BTW: It is bad practice to run sql services with admin privilages
>> > <EM> we are in process of changing this
>> >>
>> >> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
>> >> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
>> >> > What can cause the message "Login failed for user 'DOMAIN\COMPUTER$'
>> >> > "
>> >> > every
>> >> > 20 sec? the instance is Standard SQL server 2000 with mixed
>> >> > security
>> >> > mode
>> >> > and sql server service accout is domain admin member. The
>> >> > application
>> >> > that
>> >> > use database is working fine but out error log fills up very fast. I
>> >> > will
>> >> > appreciate any advise.
>> >>
>> >>
>> >>
>>|||ok ...there is misunderstanding no not that kind of standalone server : ) its
just an application server obviously a domain member
and ...w2000 domain
"David J. Cartwright" wrote:
> O.K lemmi get this straight...the sql server is a 'standalone' server,
> meaning that it is NOT a member of the domain, but it is using domain
> accounts (more specificaly, a domain admin account) to run the services '
> also what kinda domain is this NT4/2000/2003 ? and what level is it running
> at ? (this will help me answer the computer account prob)
> ---
> http://support.microsoft.com/default.aspx?scid=kb;en-us;325850
> http://support.microsoft.com/default.aspx?scid=kb;en-us;260575
> ---
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...
> >
> > thanks David,
> >
> > please see my answers below
> > "David J. Cartwright" wrote:
> >
> >> Is the account 'appacccount' loging in from an application on this remote
> >> computer?
> > <EM> yes ...exactly from the same server
> >> The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is
> >> when
> >> the computer domain account has gotten out of sync. But i dont know why
> >> this
> >> would show up in the sql log...if this is the computer that the
> >> appaccount
> >> acount is loging in from and they happen at same time...i would check
> >> make
> >> sure that the computers account is in synce...ie thats its p/w has been
> >> set/reset with the domain
> > <EM>How can I check computer account? pls advise
> >> did you mean server is a 'member' server or is it realy a 'standolone'
> >> server...?
> >>
> > <EM> its standalone server
> >> - David
> >>
> >> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> >> news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
> >> >
> >> >
> >> > "David J. Cartwright" wrote:
> >> >
> >> >> Is this showing up in sql errorlog or system log ?
> >> > <EM> In sql error log
> >> >
> >> >> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
> >> >> computer
> >> >> ?
> >> > <EM> DOMAIN\COMPUTER$ is for the remote computer.
> >> >
> >> >> How did you set the service account user names ?
> >> > <EM> members of domain admin group
> >> >
> >> >> Have you thought about setting and audit (Remember SQL Can do C2), and
> >> >> watching realtime with profiler ?
> >> > <EM> I did this the message appears when application account
> >> > DOMAIN\appaccount is login / logout to sql server. Its not a threat at
> >> > all
> >> > so
> >> > no sence to use C2
> >> >
> >> >> Is this computer a domain contoler and/r any FSMO Role
> >> > <EM> no the computer thats tryng to log is standalone backup server
> >> >
> >> >> BTW: It is bad practice to run sql services with admin privilages
> >> > <EM> we are in process of changing this
> >> >>
> >> >> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> >> >> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> >> >> > What can cause the message "Login failed for user 'DOMAIN\COMPUTER$'
> >> >> > "
> >> >> > every
> >> >> > 20 sec? the instance is Standard SQL server 2000 with mixed
> >> >> > security
> >> >> > mode
> >> >> > and sql server service accout is domain admin member. The
> >> >> > application
> >> >> > that
> >> >> > use database is working fine but out error log fills up very fast. I
> >> >> > will
> >> >> > appreciate any advise.
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>
>
>|||I ve created new login for that account 'domain\computer$' and the problem
was fixed
"Eli Milkova" wrote:
> ok ...there is misunderstanding no not that kind of standalone server : ) its
> just an application server obviously a domain member
> and ...w2000 domain
> "David J. Cartwright" wrote:
> > O.K lemmi get this straight...the sql server is a 'standalone' server,
> > meaning that it is NOT a member of the domain, but it is using domain
> > accounts (more specificaly, a domain admin account) to run the services '
> >
> > also what kinda domain is this NT4/2000/2003 ? and what level is it running
> > at ? (this will help me answer the computer account prob)
> > ---
> > http://support.microsoft.com/default.aspx?scid=kb;en-us;325850
> > http://support.microsoft.com/default.aspx?scid=kb;en-us;260575
> > ---
> >
> > "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> > news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...
> > >
> > > thanks David,
> > >
> > > please see my answers below
> > > "David J. Cartwright" wrote:
> > >
> > >> Is the account 'appacccount' loging in from an application on this remote
> > >> computer?
> > > <EM> yes ...exactly from the same server
> > >> The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is
> > >> when
> > >> the computer domain account has gotten out of sync. But i dont know why
> > >> this
> > >> would show up in the sql log...if this is the computer that the
> > >> appaccount
> > >> acount is loging in from and they happen at same time...i would check
> > >> make
> > >> sure that the computers account is in synce...ie thats its p/w has been
> > >> set/reset with the domain
> > > <EM>How can I check computer account? pls advise
> > >> did you mean server is a 'member' server or is it realy a 'standolone'
> > >> server...?
> > >>
> > > <EM> its standalone server
> > >> - David
> > >>
> > >> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> > >> news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
> > >> >
> > >> >
> > >> > "David J. Cartwright" wrote:
> > >> >
> > >> >> Is this showing up in sql errorlog or system log ?
> > >> > <EM> In sql error log
> > >> >
> > >> >> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
> > >> >> computer
> > >> >> ?
> > >> > <EM> DOMAIN\COMPUTER$ is for the remote computer.
> > >> >
> > >> >> How did you set the service account user names ?
> > >> > <EM> members of domain admin group
> > >> >
> > >> >> Have you thought about setting and audit (Remember SQL Can do C2), and
> > >> >> watching realtime with profiler ?
> > >> > <EM> I did this the message appears when application account
> > >> > DOMAIN\appaccount is login / logout to sql server. Its not a threat at
> > >> > all
> > >> > so
> > >> > no sence to use C2
> > >> >
> > >> >> Is this computer a domain contoler and/r any FSMO Role
> > >> > <EM> no the computer thats tryng to log is standalone backup server
> > >> >
> > >> >> BTW: It is bad practice to run sql services with admin privilages
> > >> > <EM> we are in process of changing this
> > >> >>
> > >> >> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> > >> >> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> > >> >> > What can cause the message "Login failed for user 'DOMAIN\COMPUTER$'
> > >> >> > "
> > >> >> > every
> > >> >> > 20 sec? the instance is Standard SQL server 2000 with mixed
> > >> >> > security
> > >> >> > mode
> > >> >> > and sql server service accout is domain admin member. The
> > >> >> > application
> > >> >> > that
> > >> >> > use database is working fine but out error log fills up very fast. I
> > >> >> > will
> > >> >> > appreciate any advise.
> > >> >>
> > >> >>
> > >> >>
> > >>
> > >>
> > >>
> >
> >
> >
message in sql server error log
20 sec? the instance is Standard SQL server 2000 with mixed security mode
and sql server service accout is domain admin member. The application that
use database is working fine but out error log fills up very fast. I will
appreciate any advise."Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> every
> 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> and sql server service accout is domain admin member. The application that
> use database is working fine but out error log fills up very fast. I will
> appreciate any advise.
Just a guess here, but that domain account will need to have local admin
permissions on your SQL Server.
In addition, you may need to set the Run As a Service permission, or Log On
as a Service.. Something like that. <shrug>
I'm sure others can expand on this.
Rick Sawtell
MCT, MCSD, MCDBA|||Is this showing up in sql errorlog or system log ?
Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote computer
?
How did you set the service account user names ?
Have you thought about setting and audit (Remember SQL Can do C2), and
watching realtime with profiler ?
Is this computer a domain contoler and/r any FSMO Role
BTW: It is bad practice to run sql services with admin privilages
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
> What can cause the message "Login failed for user 'DOMAIN\COMPUTER$' "
> every
> 20 sec? the instance is Standard SQL server 2000 with mixed security mode
> and sql server service accout is domain admin member. The application that
> use database is working fine but out error log fills up very fast. I will
> appreciate any advise.|||"David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
news:ee1GqLtvFHA.3152@.TK2MSFTNGP12.phx.gbl...
> Is this showing up in sql errorlog or system log ?
> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote
> computer ?
> How did you set the service account user names ?
> Have you thought about setting and audit (Remember SQL Can do C2), and
> watching realtime with profiler ?
> Is this computer a domain contoler and/r any FSMO Role
> BTW: It is bad practice to run sql services with admin privilages
>
Don't they need local admin rights? It's been a while since I've had to do
a setup like that.
Rick Sawtell|||"David J. Cartwright" wrote:
> Is this showing up in sql errorlog or system log ?
<EM> In sql error log
> Is the COMPUTER in DOMAIN\COMPUTER$ the local computer or a remote compute
r
> ?
<EM> DOMAIN\COMPUTER$ is for the remote computer.
> How did you set the service account user names ?
<EM> members of domain admin group
> Have you thought about setting and audit (Remember SQL Can do C2), and
> watching realtime with profiler ?
<EM> I did this the message appears when application account
DOMAIN\appaccount is login / logout to sql server. Its not a threat at all s
o
no sence to use C2
> Is this computer a domain contoler and/r any FSMO Role
<EM> no the computer thats tryng to log is standalone backup server
> BTW: It is bad practice to run sql services with admin privilages
<EM> we are in process of changing this
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:4A68C8F3-CFAC-4D46-BAD2-B33E7616C53F@.microsoft.com...
>
>|||SQL Server only *needs access to its files (system files, and dta
files...usualy C:\Program Files\Microsoft SQL Server..." and its reqistry
keys...
to keep a machine more secure minimize the access that the service account
have
If the service is running with local admin rights...and the sql server is
hacked, then the whole system is comprimised (CmdExec)
"Rick Sawtell" <r_sawtell@.hotmail.com> wrote in message
news:O4X4EVtvFHA.1252@.TK2MSFTNGP09.phx.gbl...
> "David J. Cartwright" <davidcartwright@.hotmail.com> wrote in message
> news:ee1GqLtvFHA.3152@.TK2MSFTNGP12.phx.gbl...
> Don't they need local admin rights? It's been a while since I've had to
> do a setup like that.
> Rick Sawtell
>|||Is the account 'appacccount' loging in from an application on this remote
computer?
The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is when
the computer domain account has gotten out of sync. But i dont know why this
would show up in the sql log...if this is the computer that the appaccount
acount is loging in from and they happen at same time...i would check make
sure that the computers account is in synce...ie thats its p/w has been
set/reset with the domain
did you mean server is a 'member' server or is it realy a 'standolone'
server...?
- David
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...[vbcol=seagreen]
>
> "David J. Cartwright" wrote:
>
> <EM> In sql error log
>
> <EM> DOMAIN\COMPUTER$ is for the remote computer.
>
> <EM> members of domain admin group
>
> <EM> I did this the message appears when application account
> DOMAIN\appaccount is login / logout to sql server. Its not a threat at all
> so
> no sence to use C2
>
> <EM> no the computer thats tryng to log is standalone backup server
>
> <EM> we are in process of changing this|||thanks David,
please see my answers below
"David J. Cartwright" wrote:
> Is the account 'appacccount' loging in from an application on this remote
> computer?
<EM> yes ...exactly from the same server
> The only other time i have seen DOMAIN\COMPUTER$ (With the $ sign) is when
> the computer domain account has gotten out of sync. But i dont know why th
is
> would show up in the sql log...if this is the computer that the appaccoun
t
> acount is loging in from and they happen at same time...i would check mak
e
> sure that the computers account is in synce...ie thats its p/w has been
> set/reset with the domain
<EM>How can I check computer account? pls advise
> did you mean server is a 'member' server or is it realy a 'standolone'
> server...?
>
<EM> its standalone server
> - David
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:30150C5D-30EC-4325-908D-86FB7D52E81B@.microsoft.com...
>
>|||O.K lemmi get this straight...the sql server is a 'standalone' server,
meaning that it is NOT a member of the domain, but it is using domain
accounts (more specificaly, a domain admin account) to run the services '
also what kinda domain is this NT4/2000/2003 ? and what level is it running
at ? (this will help me answer the computer account prob)
---
http://support.microsoft.com/defaul...kb;en-us;325850
http://support.microsoft.com/defaul...kb;en-us;260575
---
"Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...[vbcol=seagreen]
> thanks David,
> please see my answers below
> "David J. Cartwright" wrote:
>
> <EM> yes ...exactly from the same server
> <EM>How can I check computer account? pls advise
> <EM> its standalone server|||ok ...there is misunderstanding no not that kind of standalone server : ) it
s
just an application server obviously a domain member
and ...w2000 domain
"David J. Cartwright" wrote:
> O.K lemmi get this straight...the sql server is a 'standalone' server,
> meaning that it is NOT a member of the domain, but it is using domain
> accounts (more specificaly, a domain admin account) to run the services '
> also what kinda domain is this NT4/2000/2003 ? and what level is it runnin
g
> at ? (this will help me answer the computer account prob)
> ---
> http://support.microsoft.com/defaul...kb;en-us;325850
> http://support.microsoft.com/defaul...kb;en-us;260575
> ---
> "Eli Milkova" <EliMilkova@.discussions.microsoft.com> wrote in message
> news:AB1FE5AD-002B-42A6-B2F7-16DD0E355586@.microsoft.com...
>
>
mesage in Sql Server 2000 log
box.
Now , message
"SQL Server has encountered 1 occurrence(s) of IO requests taking
longer than 15 seconds to complete on file [D:\DATABASE\xxxxxx.MDF] in
database [aaaaaaa] (7). The OS file handle is 0x00000354. The offset
of the latest long IO is: 0x00000086692000"
has occasionally occurred during a scheduled task of reorganize data
and index pages of
database maintenance plan.
The scheduled task is running every day started at 1:00 am and the
message occurs during
no users have connected to the DB.
Please kindly explain what the message is about and how to prevent it
to occurred if it is
serious
Thank you
NiponNiponW (niponw@.yahoo.com) writes:
> I 'm using SQL Server 2000 Enterprise Edition in Windows 2000 Sever
> box.
> Now , message
> "SQL Server has encountered 1 occurrence(s) of IO requests taking
> longer than 15 seconds to complete on file [D:\DATABASE\xxxxxx.MDF] in
> database [aaaaaaa] (7). The OS file handle is 0x00000354. The offset
> of the latest long IO is: 0x00000086692000"
> has occasionally occurred during a scheduled task of reorganize data
> and index pages of
> database maintenance plan.
> The scheduled task is running every day started at 1:00 am and the
> message occurs during
> no users have connected to the DB.
> Please kindly explain what the message is about and how to prevent it
> to occurred if it is
> serious
This is a diagnostic message, that indeed may indicate that things are
not really up to shape. But if it occurs only occasionally, I would not
take any action now more than to continue to monitori the situation.
You can read more in this KB article:
http://support.microsoft.com/?kbid=897284
--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx