locked
SQL SERVER 2005 login failed message for sa login RRS feed

  • Question

  • Hello everyone,

    Since last so many days i am seeing that someone is trying to login to sql server through login name sa.but that login is failed.and this is occuring constantly.

    Earlier i had same login failed message for another ip address.i have blocked that ip address through access-list in firewall.but now i am seeing the same message for another ip address.

    (1).how can i permenently remove this message from Event log.

    (2).What is the impact of this on sql server performance.is sql server performance degraded by this kind of contineous attack?

    here i am attaching that report from event viewer log file.

    2/26/2007 1:48:18 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:17 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:17 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:17 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:16 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:16 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:16 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:15 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:15 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:15 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:14 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:14 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:14 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:13 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:13 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:12 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:12 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:12 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:11 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:11 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:11 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:10 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:10 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:10 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:09 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:09 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:09 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:08 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:08 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:08 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:07 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:07 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:07 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:06 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:06 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:06 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:05 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:05 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:05 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:04 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:04 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:04 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:03 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:02 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:02 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:02 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:01 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:01 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:01 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:00 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:00 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:48:00 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:59 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:59 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:59 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:58 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:58 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:57 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:57 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:57 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:56 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:56 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:55 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:55 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:54 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:54 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:54 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:53 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:53 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:53 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:52 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:52 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:52 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:51 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:51 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:50 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:50 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:50 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:49 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:49 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:49 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:48 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:48 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:48 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:48 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:47 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:47 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:47 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:46 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:46 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:45 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:45 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:45 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:44 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:44 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:44 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:43 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:43 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]
    2/26/2007 1:47:43 AM MSSQL$CASHMAX Failure Audit (4) 18456 N/A CASHMAX Login failed for user 'sa'. [CLIENT: 192.192.81.126]

    Needs your help to resolve this issue.

     

    Thanks,

    Bharat

    Monday, February 26, 2007 8:10 PM

Answers

  • If you only expect connections from a limited set of IPs, you could set your firewall to reject anything else.

    Every such login attempt will consume some CPU time validating the connection attempt. With SQL Server 2005, you can make the unsuccessful attempts fail more efficiently by renaming the sa account. In addition to renaming it, you might also want to consider disabling the account.

    Thanks
    Laurentiu

    Tuesday, February 27, 2007 12:54 AM

All replies

  • If you only expect connections from a limited set of IPs, you could set your firewall to reject anything else.

    Every such login attempt will consume some CPU time validating the connection attempt. With SQL Server 2005, you can make the unsuccessful attempts fail more efficiently by renaming the sa account. In addition to renaming it, you might also want to consider disabling the account.

    Thanks
    Laurentiu

    Tuesday, February 27, 2007 12:54 AM
  •    As additional information, I would also like to recommend the following topic from BOL:

    Security Considerations for a SQL Server Installation

     

    -Raul Garcia

    SDE/T

    SQL Server Engine

    Tuesday, February 27, 2007 1:04 AM