I'm seeing a ton of these
error 5023, events in my AWS RDS SqlExpress instance. I noticed this while trying to investigate timeout errors I started getting in my .Net app. However, I do not see any failed logins but I have a suspicion it may be related to what I am experiencing, which is occasional timeouts.
I've used the following queries to attempt to identify the root cause but to no avail:
SELECT CONVERT (varchar(30), GETDATE(), 121) as runtime, dateadd (ms, (a.[Record Time] - sys.ms_ticks), GETDATE()) as [Notification_Time], a.* , sys.ms_ticks AS [Current Time] FROM (SELECT x.value('(//Record/Error/ErrorCode)', 'varchar(30)') AS [ErrorCode], x.value('(//Record/Error/CallingAPIName)', 'varchar(255)') AS [CallingAPIName], x.value('(//Record/Error/APIName)', 'varchar(255)') AS [APIName], x.value('(//Record/Error/SPID)', 'int') AS [SPID], x.value('(//Record/@id)', 'bigint') AS [Record Id], x.value('(//Record/@type)', 'varchar(30)') AS [Type], x.value('(//Record/@time)', 'bigint') AS [Record Time] FROM (SELECT CAST (record as xml) FROM sys.dm_os_ring_buffers WHERE ring_buffer_type = 'RING_BUFFER_SECURITY_ERROR') AS R(x)) a CROSS JOIN sys.dm_os_sys_info sys ORDER BY a.[Record Time] ASC DECLARE @dftrc nvarchar(256) SELECT @dftrc=CAST(value as nvarchar(256)) FROM fn_trace_getinfo(default) WHERE property = 2 SELECT * FROM fn_trace_gettable (@dftrc,default ) WHERE EventClass= 20 ORDER BY starttime DESC EXEC sp_readerrorlog 0, 1, 'Login failed' ;WITH RingBufferConnectivity as ( SELECT records.record.value('(/Record/@id)', 'int') AS [RecordID], records.record.value('(/Record/ConnectivityTraceRecord/RecordType)', 'varchar(max)') AS [RecordType], records.record.value('(/Record/ConnectivityTraceRecord/RecordTime)', 'datetime') AS [RecordTime], records.record.value('(/Record/ConnectivityTraceRecord/SniConsumerError)', 'int') AS [Error], records.record.value('(/Record/ConnectivityTraceRecord/State)', 'int') AS [State], records.record.value('(/Record/ConnectivityTraceRecord/Spid)', 'int') AS [Spid], records.record.value('(/Record/ConnectivityTraceRecord/RemoteHost)', 'varchar(max)') AS [RemoteHost], records.record.value('(/Record/ConnectivityTraceRecord/RemotePort)', 'varchar(max)') AS [RemotePort], records.record.value('(/Record/ConnectivityTraceRecord/LocalHost)', 'varchar(max)') AS [LocalHost] FROM ( SELECT CAST(record as xml) AS record_data FROM sys.dm_os_ring_buffers WHERE ring_buffer_type= 'RING_BUFFER_CONNECTIVITY' ) TabA CROSS APPLY record_data.nodes('//Record') AS records (record) ) SELECT RBC.*, m.text FROM RingBufferConnectivity RBC LEFT JOIN sys.messages M ON RBC.Error = M.message_id AND M.language_id = 1033 WHERE RBC.RecordType='Error' --Comment Out to see all RecordTypes ORDER BY RBC.RecordTime DESC
Here is a detailed look at the 5023 event:
call_stack 0x00007FF97C080B89 0x00007FF97BFAE8AF 0x00007FF97BFB0BB5 0x00007FF97BFAD741 0x00007FF97BFACBE2 0x00007FF97C080BA4 0x00007FF97BFB34C8 0x00007FF97BE502F3 0x00007FF97B0D57BD 0x00007FF97B0D55A5 0x00007FF97B0D51FD 0x00007FF97B0F0D18 0x00007FF97B0F0DB0 0x00007FF97B0F08D7 0x00007FF97B0F1038 0x00007FF99BD213D2
I'm also see a
connectivity_ring_buffer_recorded event, but far less frequent, maybe 1:1000. However, I believe it is related, please correct me if I'm wrong. Here is the important detailed information from that event:
tds_flags DisconnectDueToReadError, NetworkErrorFoundInInputStream, NormalDisconnect
Honestly not sure how to begin troubleshooting this issue with the AWS RDS Instance. The only problem is the timeouts, but I have other processes running in parallel with no issue using identical sql login credentials and I don't see any failed logins anywhere which makes me think the error code is erroneous or I'm misapprehending the error codes and their implications.
I've tried googling this and scoured SO, but haven't found a solution, or similar problem, e.g. the queries I tried executing should have returned failed logins.
My AWS forums post link: https://forums.aws.amazon.com/thread.jspa?messageID=814125󆰭