Member Avatar for didyouthink76

i am constantly receiving a 'failure audit' error 18456 state 14...login failed for user 'sa' on my sql 2005 server. this is occurring every 5 minutes. Can someone give me a direction on where to start? I have checked several forums on the web, but none seem to lead me to the right direction because i am not sure where to even start. This is very annoying when my event log is filling up rather quickly.....ugh....


A little background history....had an old demo database that was continually growing but no one was using it. Could these two things be related? I had the company that installed the demo database also remove it and shortly after I was receiving these 18456 errors. Please help....
Any help is greatly appreciated.

  • 2 Contributors
  • 5 Replies
  • 128 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by sknake
Member Avatar for sknake

Trace where the connection is coming from using the SQL Server Profiler.

Start->Programs->MS SQL Server 2005->Performance Tools->Profiler.

you will want to trace the login Failed Event. You can remove any others, as they will just be noise for this.

File - New Trace
Connected with Windows Authentication
Under Events Selection Checked Show All Events
Checked Audit Login Failed

Get the same error as before

Under NTUsername I get errors for datatron and errors for system

Borrowed from:
http://www.dbforums.com/microsoft-sql-server/1639573-failure-audit-login-failed.html

Member Avatar for didyouthink76

Under the heading NTUsername I got: system and a user name for the server.

Member Avatar for sknake

You need an IP address or machine name connecting so you can find out what computer is initiating the failed logins, right? Once you identify a machine then you will identify the software on it causing the errors...

Member Avatar for didyouthink76

You need an IP address or machine name connecting so you can find out what computer is initiating the failed logins, right? Once you identify a machine then you will identify the software on it causing the errors...

Where am I getting the IP address in the trace? I guess i am not too sure what I am actually looking for here. The only thing found under NTuser name column is system. Can you please tell me where to find the IP address as I cannot seem to find the machine that is causing this.

Member Avatar for sknake

What version of SQL Server are you running? In SQL 2005 when I start a new trace there is a second tab on the screen called "Events selection". On that page near the bottom right is a checkbox for "Show all columns", select that. When the additional columns are shown you can select "hostname" which should give you the DNS information for the client connection. You may want to enable all of the columns for debugging purposes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.