Strange Login and AppDomain xx created

Question

On a sql 2k16, when I go through error logs, I find a lot of messages las follows

Server Date Process Count Text
SQL2K12 2021-03-15 13:30:44.640 spid17s 1 AppDomain 39 (MDS.mds_schema_user[runtime].38) unloaded.
SQL2K12 2021-03-15 13:00:15.550 spid62 1 AppDomain 40 (master.sys[runtime].39) created.
SQL2K12 2021-03-15 13:00:15.550 spid62 1 AppDomain 40 (master.sys[runtime].39) created.
SQL2K12 2021-03-15 10:00:43.090 spid45s 1 AppDomain 39 (MDS.mds_schema_user[runtime].38) created.

Not sure what this appDomain creating and unloading?
Thanks

Answer 1

That is completely normal and expected when you are running MDS.

Answer 2

After 2 hours, I see nothing in the trace file

Answer 3

After 4 hours of waiting, trace stopped and I have the following

Answer 4

Hello All, sorry for being late but I needed a lot of time to find the right parameters for the SQL profiler, finally I was able to nail down who was trying to use this login. In fact it is a job that runs against a Biztalk Database. Here are couple of lines of the trace.

EventClass TextData ApplicationName NTUserName LoginName DatabaseID DatabaseName EventSequence EventSubClass HostName LoginSid NTDomainName ServerName SessionLoginName TransactionID XactSequence Severity State GroupID
162 Changed database context to 'BizTalkMsgBoxDb'. SQLAgent - TSQL JobStep (Job 0x0235365006525D458358CC7A59C84CA8 : Step 1) SQLSERVERAGENT NT SERVICE\SQLSERVERAGENT 44 BizTalkMsgBoxDb 111095 NULL SQL2K12 0x010600000000000550000000DCA88F14B79FD47A992A3D8943F829A726066357 NT SERVICE SQL2K12 SALAM\SQL2K12$ NULL 0 10 2 1
162 Changed language setting to us_english. SQLAgent - TSQL JobStep (Job 0x0235365006525D458358CC7A59C84CA8 : Step 1) SQLSERVERAGENT NT SERVICE\SQLSERVERAGENT 44 BizTalkMsgBoxDb 111096 NULL SQL2K12 0x010600000000000550000000DCA88F14B79FD47A992A3D8943F829A726066357 NT SERVICE SQL2K12 SALAM\SQL2K12$ NULL 0 10 1 1

I tried to search msdb for the jbo step but cant find any trace for the job step mentioned "SQLAgent - TSQL JobStep (Job 0x0235365006525D458358CC7A59C84CA8 : Step 1)

When I run this sql against steps table, no step with 0x0235365006525D458358CC7A59C84CA8 id as you can notice

Select step_uid, database_name, step_id   from dbo.sysjobsteps 
WHERE database_name = 'BizTalkMsgBoxDb'

3BF7FD9C-684E-40C9-AC2A-DBDDD4D7F4A3 BizTalkMsgBoxDb 1
1C4F99EE-B6B1-4890-B2F5-96209491937E BizTalkMsgBoxDb 1
FAC2B44A-60B7-450B-B985-216FD285C0E6 BizTalkMsgBoxDb 1
9D26AF3A-ABAD-4089-9503-CAF41A2383C5 BizTalkMsgBoxDb 1
36A0EE9A-7C1F-4A44-A06F-324A6F01C4FE BizTalkMsgBoxDb 1
CFACD8F2-14AD-4E2D-94C4-4A89EFBB0799 BizTalkMsgBoxDb 1
0495D9AE-2835-4C99-A6EF-E820CF2AC4DF BizTalkMsgBoxDb 1
496AE9C3-EE78-4D14-AB42-7729BE8303B2 BizTalkMsgBoxDb 1

Answer 5

Hi, you are correct, I was able to find the record in jobsteps. However, it is strange, why it is using a login "sql2k12$" which is the name of mt sql server and as you can notice in the snapshot it runs under my user and not "sql2k12$" , plus the job is disabled!!