Failure Audit message in SQL Server - Event ID: 18456 every minute?
This is a event log error I have seen in Project Server 2007 on various farms going right back to the Beta and I finally found some time to track it down. It didn't seem to be breaking anything on my server, but made it difficult to read the logs and see other "important" stuff. This is the error:
Event Type: Failure Audit
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 18456
Date: 1/17/2008
Time: 1:29:00 PM
User: DOMAIN\User
Computer: SERVERNAME
Description:
Login failed for user 'DOMAIN\user'. [CLIENT: <local machine>]
I did a SQL Profiler trace to see where it was coming from and discovered the cause was a SQL Server Agent job called SharedServices_DB_Job_DeleteExpiredSessions that was running every minute. The reason for the failure was that I did not have a SharedServices_DB on that server. I did once - but my test server gets changed around a fair bit and this was a remnant that didn't get cleaned up. Not sure if it would normally get removed and if I did something bad which left it hanging around.
This could also happen with Microsoft Office SharePoint Server 2007 even if Project isn't installed as it relates to the Shared Services Provider. To disable the job you can go to SQL Management Studio, and connect to your database engine, then expand SQL Server Agent - select the Disable option.
There will likely be other valid jobs there too - for your real SharedServices databases that still exist. The bad one will show that it has failed when last executed if you look in the Job Activity Monitor.
Not a big problem - but at least disabling will keep the logs looking clean, and will save a few CPU cycles for some real work.
Technorati Tags: Project Server 2007
