3

So I've noticed thousands of login failed for user S.A. after I've changed sa password. We all agreed with this, its a test environment and nobody was using SA and since i'm new here I would like to have all SA password. Nobody noticed any problem, but I can see this strange behavior running a trace on the server:

enter image description here

I've never seen such thing. hostname and appname is just random characters. Has anyone seen this before?

The login is failing so this query above has no use:

SELECT s.session_id, s.login_name, DB_NAME(s.database_id) as database_name, 
    s.host_name, s.program_name, c.client_net_address, client_tcp_port,
    c.net_transport, c.auth_scheme, s.login_time
FROM sys.dm_exec_sessions s
INNER JOIN sys.dm_exec_connections c 
ON s.session_id = c.session_id
ORDER BY s.session_id

closed as off-topic by Tony Hinkle, mustaccio, John Eisbrener, Laurenz Albe, Philᵀᴹ Oct 16 at 12:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Too localized - this could be because your code has a typo, basic error, or is not relevant to most of our audience. Consider revising your question so that it appeals to a broader audience. As it stands, the question is unlikely to help other users (regarding typo questions, see this meta question for background)." – Tony Hinkle, mustaccio, John Eisbrener, Laurenz Albe, Philᵀᴹ
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Is this DB accessible from outside your network? perhaps someone is trying to brute force their way in. – scsimon Oct 15 at 17:29
  • Oh I didn't think about that ( About being accesible from outside ). I will verify this. I just thought it was brute force. – Racer SQL Oct 15 at 17:39
  • yes it is accessible from outside. I could find 2 ips and one is from russia and the other one is from hong kong. – Racer SQL Oct 15 at 18:09
  • 4
    ding ding ding.... at least you know where it's coming from now! Unless, of course, you expect that. Otherwise, you're going to hero when you patch that firewall hole. – scsimon Oct 15 at 18:13

Browse other questions tagged or ask your own question.