locked
SQL error log too big because attack from Asia/Chine RRS feed

  • Question

  • Hello
    I have around 60 attempts every minute to connect to SQL 2008 from Asia/Chine. So SQL error log  increase to 100 Gb every month... and this is a problem ..no space on HD. I'll appreciate any help.

    2020-04-07 16:03:05.08 Logon       Login failed for user 'sa'. Reason: An attempt to login using SQL authentication failed. Server is configured for Windows authentication only. [CLIENT: 116.58.43.106]
    2020-04-07 16:03:05.09 Logon       Error: 18456, Severity: 14, State: 58. [CLIENT: 210.215.128.65]
    2020-04-07 16:03:05.09 Logon       Error: 18456, Severity: 14, State: 58. [CLIENT: 93.145.209.60]

     



    Tuesday, April 7, 2020 9:14 PM

All replies

  • You know it already: don't expose your SQL Server directly to the internet.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

    Tuesday, April 7, 2020 9:53 PM
  • Hi, while you address this security issue, you can run sp_cycle_errorlog to cycle the errorlog and the delete the large file. Note: If you need the errorlog file for further analysis you should copy it to another location before deleting. This will help you reclaim some space. https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-cycle-errorlog-transact-sql
    Wednesday, April 8, 2020 12:44 AM
  • Hi GaryGold777,

    It seems that your SQL Server have been exposed to the public Internet, consider whether it needs to be exposed. In current case, you need to configure firewall properly, blacklist this IP address and let only IP address you trust access your server.

    for error log too big, you could check this post.

    Best Regards,
    Cris


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Wednesday, April 8, 2020 4:02 AM
  • Hi GaryGold777,

    Was your issue resolved?
    If you have resolved your issue, please mark the useful reply as answer. This can be beneficial to other community members reading the thread.
    In addition, if you have another questions, please feel free to ask.
    Thanks for your contribution.

    Best regards,
    Cris


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Monday, April 13, 2020 3:15 AM