Stop Event 18456 logging 1

[porkchopexpress]

Since moving to SQL 2005 one of our apps logs three security failure errors in the Windows Application event log every time a user logs on. I've spoken to the developers and they say it's due to changes to security in SQL2005 and certain parts of their code causing the events and it's nothing to worry about.
The problem is that it's filling the application log on the server, is there a way to stop this logging for now until they get it sorted?

Thanks.

 

[ptheriault]

You have to change the auditlevel. By default it is set to log failed logins.

Right click on the server name in SSMS and select properties. On the Security page you can change the audit level.

I would try and find the reason it is failing and fix it. Here is a table to help you.

The key to the message is the 'State' which the server will accurately set to reflect the source of the problem. In the example above, State 8 indicates that the authentication failed because the user provided an incorrect password. The common error states and their descriptions are provided in the following table:

ERROR STATE ERROR DESCRIPTION
2 and 5 Invalid userid
6 Attempt to use a Windows login name Authentication
7 Login disabled and password mismatch
8 Password mismatch
9 Invalid password
11 and 12 Valid login but server access failure
13 SQL Server service paused
18 Change password required

- Paul
- If at first you don't succeed, find out if the loser gets anything.

 

[porkchopexpress]

I'm seeing state 5 and 8. The usernames are in the Db and apparently aren't used anymore but some code tries them still.

Thanks.

 

[ptheriault]

I would tell your developers to fix it! But if you have to you can change the audit level.

- Paul
- If at first you don't succeed, find out if the loser gets anything.

 

[porkchopexpress]

I think the pressure will be building on the developers as they are making everyone move to 2005 soon, if the logging becomes a problem at least i know how to stop it temporarily.

Cheers.