Recurring Event 18456 in event log, Login Failed for user ''

Question

Is there a way to trace what process is attempting to connect to my local development database?
I see regular bursts of about 30 attempts in a second, happening every minute. The log entry is Event 18456, MSSQLSERVER

Login failed for user ''. Reason: An attempt to login using SQL authentication failed. Server is configured for Integrated authentication only. [CLIENT: <local machine>]

I can't help feeling that something is doing a whole lot of unnecessary work on my laptop, and would like to identify and prevent this.
Does Visual Studio 2022 attempt to connect to my local database, even tho I am not using any database connections with it?
How do I trace the cause for this repeating event?

Answer 1

Hi @Les Ferguson ,
Pls follow the steps:
Check the "detials" choice of Task Manager:

Find SQL Server and check its PID

Use the order netstat -ano|find "xxxx" to see:

Cuz I don't have any connections at present so there is nothing to be shown, let's pretend there is a program being connected to my SQL and its TCP is 192.168.6.189:3758

Then you can use the following order netstat -ano |find "6.189"

And then you can get the program's ip that is connecting to your SQL.

Finally you can use the IP you got and go back to Task Manager to see what process it is.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment"

Answer 2

I guess that it should be possible to use Process Monitor from sysinternals.com to track down the connections. I am not exactly sure how you would do it, though. (Never had the need myself). But the error message suggest that this is access over shared memory.

Answer 3

Hi @Les Ferguson ,
We have not received a response from you. Did the reply could help you? If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. By doing so, it will benefit all community members who are having this similar issue. Your contribution is highly appreciated.

Answer 4

Never did find an answer. Cannot trace the logon attempts to a process. Still get the event log entry every minute.