Error 18456 Severity 14 State 38 Nt Authority System
Contents |
up Recent PostsRecent Posts Popular TopicsPopular Topics Home Search Members Calendar Who's On Home » SQL Server error 18456 severity 14 state 11 nt authority anonymous logon 2005 » Administering » Login failed for user 'NT AUTHORITY\SYSTEM',... 25 posts,Page
Error 18456 Severity 14 State 38 Sql 2008 R2
1 of 3123»»» Login failed for user 'NT AUTHORITY\SYSTEM', Very straing Rate Topic Display Mode Topic Options Author Message sql server error 18456 severity 14 state 38 stupid.brainstupid.brain Posted Saturday, March 10, 2012 12:56 PM Forum Newbie Group: General Forum Members Last Login: Sunday, May 27, 2012 12:19 PM Points: 2, Visits: 79 I get hundreds of these error 18456 severity 14 state 38 login failed messages in my SQL Server logs every day (Exactly every 15 minutes).The messages have a sev 14 and a state 16, I have been searching the web for answers, but have drawn a blank thus far.One suggestion was to run a SQL Profiler trace.I did this and found that the ApplicationName is 'Microsoft Windows Script Host', but when I checked the Task Manager
Error 18456 Severity 14 State 5
on the server, the ClientProcessID specified in the Profiler trace does not appear in the list of PIDs.I have also checked my Logins, and NT AUTHORITY\SYSTEM is present and enabled, and it has a server role of 'sysadmin', so I cannot see why the login would not be able to access any of the databases.Also, I have checked all Jobs to check any blank DB name (As a suggested solution) But I found nothing.Any help in tracking this down would be greatly appreciated. Post #1264782 Rechana RajanRechana Rajan Posted Sunday, March 11, 2012 9:28 AM SSC Veteran Group: General Forum Members Last Login: Today @ 2:36 AM Points: 200, Visits: 322 Some application must be using that login with a wrong password.When you started to get these errors?Have to changed the password for that login in recent times? Post #1264867 stupid.brainstupid.brain Posted Monday, March 12, 2012 1:01 AM Forum Newbie Group: General Forum Members Last Login: Sunday, May 27, 2012 12:19 PM Points: 2, Visits: 79 It seems like a very old error more than 3 months, the strange thing that it execute every 15 mi
(Русский)ישראל (עברית)المملكة العربية السعودية (العربية)ไทย (ไทย)대한민국 (한국어)中华人民共和国 (中文)台灣 (中文)日本 (日本語) HomeLibraryLearnDownloadsTroubleshootingCommunityForums Ask a question Quick access Forums home Browse forums users FAQ Search related threads Remove From My Forums Answered by: Failed to open the error 18456 severity 14 state 5 reason could not find a login matching the name provided explicitly specified database error SQL Server > SQL Server Setup & error 18456 severity 14 state 5 login failed for user Upgrade Question 1 Sign in to vote Hi, I've just installed a new SQL Server 2008
Error 18456 Severity 14 State 8
on Windows Server 2008 x64 (and SQL 2008 SP1), while it seems to be running well, I keep getting the same error appearing in the event log: Login http://www.sqlservercentral.com/Forums/Topic1264782-146-1.aspx failed for user 'domain\username'. Reason: Failed to open the explicitly specified database. [CLIENT: x.x.x.x] The Admin user name comes up once every 20 seconds or so, and the NT AUTHORITY\SYSTEM account appears twice every 5-6 seconds, obviously this is filling the event log pretty quickly... The SQL Server event log has: Error: 18456, Severity: 14, https://social.msdn.microsoft.com/Forums/sqlserver/en-US/11a319b7-ff47-40a3-9c0e-3a7ad74163b6/failed-to-open-the-explicitly-specified-database-error?forum=sqlsetupandupgrade State: 38. Then the above login failed message, the Windows event log has: - System - Provider [ Name] MSSQLSERVER - EventID 18456 [ Qualifiers] 49152 Level 0 Task 4 Keywords 0x90000000000000 - TimeCreated [ SystemTime] 2009-05-07T15:53:26.000Z EventRecordID 20656 Channel Application Computer servername - Security [ UserID] S-1-5-18 - EventData NT AUTHORITY\SYSTEM Reason: Failed to open the explicitly specified database. [CLIENT: x.x.x.x] 184800000E000000080000004B004100420030003100530050000000070000006D00610073007400650072000000 -------------------------------------------------------------------------------- Binary data: In Words 0000: 00004818 0000000E 00000008 0041004B 0008: 00300042 00530031 00000050 00000007 0010: 0061006D 00740073 00720065 0000 In Bytes 0000: 18 48 00 00 0E 00 00 00 .H...... 0008: 08 00 00 00 4B 00 41 00 ....S.V. 0010: 42 00 30 00 31 00 53 00 R.N.A.M. 0018: 50 00 00 00 07 00 00 00 E....... 0020: 6D 00 61 00 73 00 74 00 m.a.s.t. 0028: 65 00 72 00 00 00 e.r... I'm fairly sure that NT AUTHORITY\SYSTEM needs some sort of access to the master database, but I've tried adding t
of days ago, the following error messages started flooding error logs of some of the SQL https://sqlsheeshya.wordpress.com/2015/09/10/login-failed-for-user-nt-authoritysystem-reason-failed-to-open-the-explicitly-specified-database/ instances we support. Source:Logon Login failed for user ‘NT http://www.ssistalk.com/2011/05/06/quick-tip-error-18456-severity-14-state-38/ AUTHORITY\SYSTEM'. Reason: Failed to open the explicitly specified database ‘XXXX'. Error: 18456, Severity: 14, State: 38. These messages were getting logged every 5-7 minutes. From the error message, it was clear that login ‘NT AUTHORITY\SYSTEM’ did not have access error 18456 to databases. (Check this detailed blog by Aaron Bertrand for ‘Error:18456’ messages.) I compared security properties of ‘NT AUTHORITY\SYSTEM' on SQL instances - Where error messages were logged and where there were no errors. The instances logging error messages had ‘NT AUTHORITY\SYSTEM' assigned as ‘public’ role. Whereas error 18456 severity other instances had ‘NT AUTHORITY\SYSTEM' assigned as ‘sysadmin’ role. I executed a SQL trace to check which application was causing this error. Following is a screen shot from trace. The trace result did not provide confirmed information on application. But from the consistent frequency of messages (i.e. every 5-7 mins), one could guess that it can be some monitoring application. That application was trying to connect the databases using ‘NT AUTHORITY\SYSTEM'. It was failing as login did not have database access explicitly defined. I was aware that ‘System Center Operations Manager’ (SCOM) is being used for monitoring. I found this TechNet link, which confirmed that, the failing application was SCOM. The errors messages stopped after assigning ‘sysadmin’ role to ‘NT AUTHORITY\SYSTEM'. Thanks! Share this:TwitterFacebookGoogleLike this:Like Loading... Related Post navigation Previous PostExplore ‘Live Query Statistics' through TechNet VirtualLabsNext PostSQL Server has
to see if a record exists Dynamic connection for file system task Ads Quick Tip: Error: 18456, Severity: 14, State: 38. SQL Server, SQL Server 2008 May 062011 When trying to investigate the SQL error, "Error: 18456, Severity: 14, State: 38." it can be frustrating when not a single log on the system will tell you what the actual problem is. In the case of state 38 (16 or 27 prior to SQL 2008) this error means the database specified in the client connection does not exist, or is offline. In a large shop with many various clients it can be hard to find out the source of the connection, so you're option is to use the tools at your disposal. The SQL Error Log does not help much at all. Here's what's in the SQL Error log: 2011-05-06 09:06:17.28 Logon Error: 18456, Severity: 14, State: 38. 2011-05-06 09:06:17.28 Logon Login failed for user ‘DOMAIN\ssrs.service'. Reason: Failed to open the explicitly specified database. [CLIENT: 192.168.0.147] The Windows Application log is not much help either. Login failed for user ‘DOMAIN\ssrs.service'. Reason: Failed to open the explicitly specified database. [CLIENT: 192.168.0.147] In other words, useless for troubleshooting. The way to obtain the database name the client is trying to connect to is to use SQL Server Profiler. To set up SQL Server Profiler, connect to the SQL instance where the error is occuring and then track the following events: Errors and Warnings: User Error Message Security Audit: Audit Login Failed For these two events, make sure you capture at least the following columns: ApplicationName, HostName, LoginName, SPID (required), StartTime, TextData (where the message text will be), Severity, State, ClientProcessID, and Error. Then run the trace. You'll see the following data under the "User Error Message" event when the login failure occurs: Cannot open database "DatabaseName" requested by the login. The login failed. For the "Audit Login Failed" event you'll see the following data: Login failed for user ‘BLUENE\ssrs.service'. Reason: Failed to open the explicitly specified database. [CLIENT: 192.168.0.147] Using this information (and the rest of the info in the other columns you selected), you should be able to go to the source and identify which process is trying to connect