So I've noticed thousands of login failed for user S.A. after I've changed sa password. We all agreed with this, its a test environment and nobody was using SA and since i'm new here I would like to have all SA password. Nobody noticed any problem, but I can see this strange behavior running a trace on the server:

enter image description here

I've never seen such thing. hostname and appname is just random characters. Has anyone seen this before?

The login is failing so this query above has no use:

SELECT s.session_id, s.login_name, DB_NAME(s.database_id) as database_name, 
    s.host_name, s.program_name, c.client_net_address, client_tcp_port,
    c.net_transport, c.auth_scheme, s.login_time
FROM sys.dm_exec_sessions s
INNER JOIN sys.dm_exec_connections c 
ON s.session_id = c.session_id
ORDER BY s.session_id

  • 1
    Is this DB accessible from outside your network? perhaps someone is trying to brute force their way in. – scsimon Oct 15 at 17:29
  • Oh I didn't think about that ( About being accesible from outside ). I will verify this. I just thought it was brute force. – Racer SQL Oct 15 at 17:39
  • yes it is accessible from outside. I could find 2 ips and one is from russia and the other one is from hong kong. – Racer SQL Oct 15 at 18:09
  • 4
    ding ding ding.... at least you know where it's coming from now! Unless, of course, you expect that. Otherwise, you're going to hero when you patch that firewall hole. – scsimon Oct 15 at 18:13

Browse other questions tagged or ask your own question.