-4

Trying to get to the bottom of the below SQL Error Log Message:

Logon failed for user 'sa'. Reason: Password did not match the login provided. [CLIENT: 172.16.30.227]
Error 18456, Severity 14, State 8
Event 3221243928

There wasn't much in terms of details in the log and wanted to make sure that there wasn't anything critical failing.

Thx in advance.

closed as too broad by Erik Darling, Philᵀᴹ, hot2use, MDCCL, LowlyDBA Dec 13 '18 at 16:26

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

The error simply states that somebody/something is trying to connect to SQL Server from IP address 172.16.30.227 using the sa account but using a wrong password.

SQL Server just rejected the connection and as far as SQL Server is concerned that is the end of it.

You won't find more information in the SQL Server logs that can help you find out who or what is trying to open that connection.

You can try logging on to the 172.16.30.227 machine and check scheduled tasks or the event log in hopes of finding an indication about what is failing there.

If it's an IP address you know (such as the server itself) it could be a script or a tool that has been scheduled before the sa password was changed or it could be something that was never configured right in the first place.

If it's an IP address you don't know, or is a workstation in your network somewhere it could be a malicious user trying to log on.

The only thing you can try to determine from SQL Server logs apart from the ip address is if there is a repetition pattern in the day or time of the error.

0

My first question to myself would be, does the IP in the error correspond to a known SQL server or application server IP address? Or a known IP of a DBA's personal computer? If not then it probably means someone who is not supposed to is trying to log into your SQL server. Might even be a hack attempt if it's someone from an authorized computer/server.

  • The ip address is the local host, the server itself. So I am guessing it is some job or process trying to log in on the server but the log only gave those details. I am able to log into SQL Management Studio with sa/password fine. No other errors I can see. – Rykoff Sexton Dec 13 '18 at 14:18
  • State 8 is a password mismatch. Is it possible there is a new linked server or new replication publication/subscription? – Alen Dec 13 '18 at 14:24
  • That is what I am trying to figure out. My confusion is that I thought that if it were the linked server trying to make the login attempt that that server IP address would be listed? Thanks for all your help. – Rykoff Sexton Dec 13 '18 at 14:34
  • I'm 99% sure i've seen this at my previous job where we had lots of linked servers using the sa account. I didn't set them up this way and had no say so in the matter. You'll probably have to run a profiler trace or extended events session to capture the exact event causing this. In my case it was a once a day process that took me a few days to catch. – Alen Dec 13 '18 at 14:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.