locked
svcSQLServer causing Failure Audit ID 673 in Security Log RRS feed

  • Question

  • Logging time has been changed in server registry to 120 minutes per a KB article regarding 673 event errors.
    Server is backup domain controller.   Running Windows 2003 Standard - fully patched.  SQL version is 2008
    This error occurs in the event log each day.   Sometimes repeating every 5 - 10 minutes.    I have modified the servername and domain name in the event.    Is there a way to fix this error?  

    Event Type: Failure Audit
    Event Source: Security
    Event Category: Account Logon
    Event ID: 673
    Date:  10/7/2009
    Time:  5:20:00 AM
    User:  NT AUTHORITY\SYSTEM
    Computer: servername
    Description:
    Service Ticket Request:
      User Name:  EMAIL GONE
      User Domain:  www.domain.com
      Service Name:  EMAIL GONE
      Service ID:  -
      Ticket Options:  0x40810000
      Ticket Encryption Type: -
      Client Address:  127.0.0.1
      Failure Code:  0x1B
      Logon GUID:  -
      Transited Services: -


    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Wednesday, October 7, 2009 2:57 PM

All replies

  • Check your database mail configuration.  This looks like someone hasn't fully or properly configured database mail, so it is failing to connect each time the process runs.
    Mike Hotek BlowFrog Software, Inc. http://www.BlowFrogSoftware.com Affordable database tools for SQL Server professionals
    Wednesday, October 7, 2009 9:40 PM
  • Hi Mike,



    Assuming that this SQL Server Database Mail... this is a SQL Server function that has never been configured or started on any of the SQL Servers. I have checked for Database Mail logs on the server, in case this function somehow started, but there are none.


    I am interested as to why you suspect SQL Database Mail is causing the error

    If this function (SQL Database Mail) is not running on the server - how it could generate this error

    Is there some other places I should be looking to confirm the services is not being called

    I am looking forward to your response.

    Thank you for your response.    Finding anyone who know what this is has been difficult
    Aggie

     

    Thursday, October 22, 2009 4:25 PM
  • If you don't have database mail configured, then it would be something outside of SQL Server causing this.  My suspicion that it could be Database Mail is based on several things:

    1. The reference to e-mail in the event log message
    2. The fact that it is a logon failure
    3. The fact that it repeats every 5 - 10 minutes

    The database mail subsystem basically interacts with the SMTP service on the machine.  If someone has partially or incorrectly configured Database Mail, then you are going to get repeating errors related to either not being able to find the mail server or not being able to authenticate (logon failure).  Database Mail automatically retries failed sends, in general, every 5 - 10 minutes up to a maximum number of retries before considering the message as failed and obsolete.

    If you run sp_configure against the instance and the run_value for Database Mail XPs is set to 1, then the Database Mail feature is enabled on the instance.  You can review the configuration by launching SSMS, connecting to the instance in the Object Explorer, Expand the Management node, right click Database Mail, and select Configure Database Mail.  You can also review the Database Mail log by selecting View Database Mail Log from that same menu.
    Mike Hotek BlowFrog Software, Inc. http://www.BlowFrogSoftware.com Affordable database tools for SQL Server professionals
    Thursday, October 22, 2009 11:04 PM