Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It only takes a minute to sign up.
Sign up to join this community
I have Windows Server 2016, with SQL Server 2017, and found Windows Log Application is full of Login failed messages (as follows) :
Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: ****]
Client's IP addresses are various. I don't have any maintenance plan in SQL Server
What's the problem?
A login attempt was made from the IP address given. The attempt was to log in using the credential sa. A password was supplied but it was not the correct password.
sa is the default sysadmin credential in SQL Server. Errorlog spam with this message usually means 1 of 2 things.
sa crendentialIf it's #1, then go to the application you're hosting at that IP address and change its webconfig.
If it's #2, then you need to blacklist that IP address - preferably by firewalling your database server off from the public internet (which you should really do anyways to be frank).
See also:
It looks like your SQL Server is exposed to Public Internet, and someone is trying to brute force (hack) password from your SA account...
I had same situation when one of my SQL Servers was in Azure and exposed to Public Internet
SOLUTION: You need to configure firewall properly to let only IP address/apps/users you trust access your SQL Server
If your SQL Server is in Azure, go configure Network Security Group;
if in on-premise data center -> configure your firewall
What's the problem?
There is no problem in writing windows application log entries, those are the entries from actual event (failed login) when it really occurred at SQL Server.
You may want to immediately disable sa account (while you maintain another sysadmin login). Second, Firewall/network configuration to not to expose the SQL server to public network (since your mentioned Clints are various of IP address). General best practice to keep only application servers exposed to public network (if necessary) and database server to app servers, if database access really needed outside use VPN instead.
Finally, following references for best practices:
Are you using SSRS? That could be a reason if you configured sa user in Data Sources.. Try to think of any other application that is using the sa account.
