We were encountering this issue too and made some discoveries that we hope will help. If you want to avoid getting spammed with “Severity 20” alert email notifications, often due to vulnerability scans from applications like Nessus, there are a couple things you can do:
In SSMS > SQL Server Agent > Alerts > find and right-click the “Severity 20” alert > Properties > Response, and instead of “Notify operators”, you can select “Execute job” and write a custom job leveraging the variables passed from the alert to the job using Tokens.
Or you can forget all that business, and simply capture and squash the specific error notifications by implementing a New Alert for that specific error number without enabling “Notify operators” in that same Response section:
USE [msdb]
GO
EXEC msdb.dbo.sp_add_alert @name=N'Error Number 17836',
@message_id=17836,
@severity=0,
@enabled=1,
@delay_between_responses=0,
@include_event_description_in=0,
@category_name=N'[Uncategorized]',
@job_id=N'00000000-0000-0000-0000-000000000000'
GO
It seems the logic is that when an error occurs, the agent first looks for any alerts by the error number. If none, it will then look by severity. I haven’t researched the exact logic on this so please don’t quote me on it, but this seems to be how it behaves.
The error #’s that most often occur during these scans are 17810, 17832, and 17836. So you’d need make a separate New Alert for each one that you want to squash.
Although rare, please be warned that these errors can occur in the event that your server is actually under attack, so monitor your logs (they still get logged even though the alert is squashed) or maybe have it execute a job if it occurs “n” times in a short period. Simply put, use at your own discretion.
HTH
