1) Login failed for user ‘null’

2) Login failed for user ‘’

3) Login failed for user 'NT Authority\Anonymous Logon‘

4) Cannot generate SSPI context

We get these errors when we use windows authentication and there is more than one hop involved in the scenario before passing the authentication to the final destination. For example while browsing a web site which use windows authentication or in case of a linked server.

Let’s take the most common example, when you are browsing a website that is hosted in IIS server and stores information in SQL database. In this case the data is stored in SQL , The web application which is hosted in a separate IIS server talks to this SQL server through windows authentication. Now when a user logs in to the web site on a third box which is also in the same domain as the IIS and SQL server and tries to browse the website, his user account is passed to SQL server via the IIS box in between.

This kind of scenario is called a double hop where the authentication is passed from the originating box (where the user actually opens the website in IE) to the final box (SQL server) in two hops (1. originating box to IIS 2. IIS box to SQL box). In these types of scenarios, Kerberos is a must. Because NTLM cannot delegate authentication in multiple hops.

For Kerberos to work we need proper SPN. If Proper SPNs are not found in active directory, we will encounter the above errors. When we say proper SPN, it means that the SPN should be in proper format, should contain the right information and should not be duplicate.

Troubleshooting

Prerequisites for Kerberos delegation to work.

1. All computers must be running Windows 2000 or later.

2. All computers must be in the same domain, or domains that trust one another.

3. The domain(s) must be using Active Directory.

4. Kerberos depends on synchronized timing between computers. Out-of-sync computer clocks may cause Kerberos authentication to fail. So all the machines involved in this scenario should have their time synchronised time.

Active Directory Settings

1. Domain users who will be connecting through IIS to SQL Server must not have their domain user accounts marked as "Account is sensitive and cannot be delegated" or should have their “Account is trusted for delegation” checked in the Active Directory Users and Computers tool.

2. The IIS server (the computer that will be delegating) must have "trust computer for delegation" Checked in the Active Directory Users and Computers tool.

3. The IWAM account in case of IIS 5 and in case of IIS 6 and higher, the Log on account for the application pool under which the web application is running must also have “Trust this user for delegation” Checked in the Active Directory Users and Computers tool.

4. It is necessary to register a "Service Principal Name" (SPN) for SQL Server if SQL Server is not running under the LocalSystem account or a domain admin account. If you are running the SQL service under LocalSystem it will automatically create a SPN for the machine account in active directory and if you are running the SQL service in a domain admin account even in that case it will create its own SPN. But if you are running the SQL account in a different domain account you need to manually create the SPN .

To Create SPN you need to have the domain admin privileges. You can use the SETSPN tools to create or delete SPNs. The SETSPN tool comes with the Windows 2000 Resource Kit Tool.

First run the command “SETSPN –L <domain\SQLService account>” to find out if there is any improper or duplicate SPN(this command does not require domain admin privilages). A valid SQL SPN should be in the format “MSSQLSvc/<FQDN of SQL Server>:<SQL Port>” ex: MSSQLSvc/SQLServer.MyDomain.Com:1433. If you find any improper or duplicate SQL SPN then delete them using the command “SETSPN –D <SPN> < domain\SQLService account >”

(You can also use a tool called Delegconfig to find out if there is a duplicate SPN. You can download this tool from the link https://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1434)

Then add the appropriate SPN with the command “SETSPN –A MSSQLSvc/<FQDN of SQL Server>:<SQL Port> < domain\SQLService account >”

If you are trying to connect to a SQL cluster you need to have two SPNs. One with the port and one without. Preferably you can create 4 SPNs in the following format:

MSSQLSvc/<virtual server name>

MSSQLSvc/<virtual server name>.<rest of FQDN>

MSSQLSvc/<virtual server name>:<port>

MSSQLSvc/<virtual server name>.<rest of FQDN>:<port>

5. For Active Directory to work correctly, DNS must also function correctly. If you are having DNS problems, Kerberos will fail, due to name lookup problems. You can do a ping –a to find out if the IP address and FQDN is being resolved properly.

Client Computers

1. Client computers must be running Internet Explorer 5.0 or later

2. In IE, it may be necessary to turn on "Enable Windows Integrated Authentication" in the browser's Advanced Options.

3. Browsers can't be going through a proxy server. If using a proxy must select option in IE to "bypass proxy for local addresses"

IIS Server

1. Only Windows Authentication, or Windows and Basic, if necessary (see below), should be enabled on the web site or virtual folder. Digest authentication does not support delegation

2. Specify a trusted connection to SQL Server with "Integrated Security=SSPI" in the connection string.

MSXML can be installed both in replace mode and side by side. For example, starting MSXML4 all the versions are installed side by side. Which means that you system might have multiple versions of MSXML installed.

But When writing code try to use MSXML  v6 as it’s the latest one, If that is not installed on a target machine , MSXML3 is generally the best fallback. Because MSXML 1 and 2 are no longer supported by Microsoft, MSXML 5 is meant only for use in Office products. And MSXML 4 is kill bited.

To know the features of each of the MSXML versions you can visit https://msdn.microsoft.com/en-us/library/ms753751(VS.85).aspx

To find out what are the versions of XML installed in your system , you can use a tool called Xmlversion.exe or Xmlversiontext.exe. Yoy can download it from the link  https://support.microsoft.com/kb/278674/en-us .

To create a XML DOM object we use code like this “Dim xmlDoc As New Msxml2.DOMDocument30”

here  Msxml2.DOMDocument30 is the progID we are using to refer a specific version of XML DOM.

MSXML has multiple versions and the ProgID is different in each on them usually in the form of ProjectName.ClassName.

For example –:

MSXML Version          PROGID

1.0                           Microsoft.XMLDOM

2.0                          Msxml.DOMDocument

3.0                          Msxml2.DOMDocument or Msxml2.DOMDocument.3.0

4.0                          Msxml2.DOMDocument.4.0

6.0                          Msxml2.DOMDocument.6.0

Visit https://support.microsoft.com/?id=305019 for more details about MSXML  GUID and ProgID.

If you use version independent progID it will refer to the lowest version between MSXML1, MSXML2 and MSXML3. From MSXML4 and later you need to use the version specific ProgID.

Another thing you need to consider is the choise between XMLHTTP and ServerXMLHTTP. XMLHTTP is designed for client applications and relies on URLMon, which is built upon Microsoft Win32 Internet (WinInet). ServerXMLHTTP is designed for server applications and relies on a new HTTP client stack, WinHTTP.

ServerXMLHTTP is recommended for server applications and XMLHTTP is recommended for client applications. For example Use ServerXMLHTTP if you want to use it in a ASP page for example and use XMLHTTP if you want to call it in java script or vb script which is executed in client side.

WinInet limits the number of simultaneous connections that it makes to a single HTTP server using XMLHTTP to 4.But there are no such limits with ServerXMLHTTP. Other than that using ServerXMLHTTP, XML data can be exchanged between local and remote systems as a stream or as XML documents. And because the underlying protocol is HTTP or HTTPS, data can be exchanged between the systems that are behind firewalls. These kind of features maked ServerXMLHTTP suitable for use at server side.

Tracing of ServerXMLHTTP is possible using a tool called Winhttptracecfg. You can download it from https://support.microsoft.com/kb/307272/en-us

If you are writing a .net application try to use System.XML instead of MSXML. As using MSXML with .net application is not supported.

https://support.microsoft.com/kb/290761

https://msdn.microsoft.com/en-us/library/ms810829.aspx

https://msdn.microsoft.com/en-us/library/8xx3tyca(vs.71).aspx

https://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;191572

Connection leak basically happens when we open a connection to the database from our application and forget to close it, or for some reasons it doesn’t get closed.

To implement connection pooling we basically use these connection string properties –;

1) Connection Lifetime (Default 0) -  When a connection is returned to the pool, its creation time is compared with the current time, and the connection is destroyed if that time span (in seconds) exceeds the value specified by Connection Lifetime. This is useful in clustered configurations to force load balancing between a running server and a server just brought online. A value of zero (0) will cause pooled connections to have the maximum time-out.

2) Pooling (Default true) -; When true, the connection is drawn from the appropriate pool, or if necessary, created and added to the appropriate pool.

3) Max Pool Size (Default 100 ) -:The maximum number of connections allowed in the pool.

4) Min Pool Size (Default 0 ) -:The minimum number of connections allowed in the pool.

5) Connect Timeout  or Connection Timeout  (Default  15) -: The length of time (in seconds) to wait for a connection to the server before terminating the attempt and generating an error.

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Try
            Dim cn As New SqlConnection("Integrated Security=SSPI;pooling=true;max pool size=2;Persist Security Info=False;Initial Catalog=master;Data Source=MYSQL2008")

            cn.Open()
        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
End Sub

In the code above we are opening a connection to a SQL server but not closing it. As a result when this event is triggered third time, we get a error message , as we run out of connections in connection pool. If we simply put a “cn.close”  statement in the above code after opening the connection it will never throw an error.

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Try
            Dim cn As New SqlConnection("Integrated Security=SSPI;pooling=true;max pool size=2;Persist Security Info=False;Initial Catalog=master;Data Source=MYSQL2008")
            Dim i As Integer
            Dim a As Integer = 0

            cn.Open()
            i = 5 / a
            cn.Close()
        Catch ex As Exception
            MsgBox(ex.Message)
        End Try

End Sub

Now look at this code. Even though we are closing the connection , but still we are facing a connection leak. The reason is that the cn.close is never getting executed as the link above it is throwing an error and the handle is passed over to the exception handling section. This kind of scenario is quite common when the developer thinks that he is closing the connection but still faces a connection leak issue.

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
     Dim cn As New SqlConnection("Integrated Security=SSPI;pooling=true;max pool size=2;Persist Security Info=False;Initial Catalog=master;Data Source=MYSQL2008")

     Try
         Dim i As Integer
         Dim a As Integer = 0

         cn.Open()
         i = 5 / a
         cn.Close()
     Catch ex As Exception
         MsgBox(ex.Message)
     Finally
         cn.Close()
     End Try
End Sub

To stop this from happening the best thing to do is to close the connection in the “Finally” section like the example above.

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Try

            Using cn As New SqlConnection("Integrated Security=SSPI;pooling=true;max pool size=2;Persist Security Info=False;Initial Catalog=master;Data Source=snehach-pri")
                cn.Open()
            End Using

        Catch ex As Exception
            MsgBox(ex.Message)
        Finally

        End Try
    End Sub

The code above is another good way to avoid connection leak. Because in the code above the compiler implicitly calls a cn.dispose immediately after the “using” block.

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
       Try

           Dim cmd As New SqlCommand("select * from emp", getconnection)
           Dim res As Integer = cmd.ExecuteNonQuery
           getconnection.Close()
       Catch ex As Exception
           MsgBox(ex.Message)
       Finally

       End Try
   End Sub

Also we need to keep in mind when we get a connection after calling a function which return a connection object, we should always cache the connection object locally and close it. In the above code the getconnection.close is not closing the connection that is used to execute the query but creating another new connection and closing it.

Errors related to Connection leak

> Timeout expired. The timeout period elapsed prior to obtaining a connection from the pool. This may have occurred because all pooled connections were in use and max pool size was reached.

> SQL Server Does Not Exist Or Access Denied

> General Network Error

Ways to confirm that its a connection leak

1> Client-Side Performance Counters
NET CLR Data
SqlClient: Current # connection pools
SqlClient: Current # pooled and nonpooled connections
SqlClient: Current # pooled connections
SqlClient: Peak # pooled connections
SqlClient: Total # failed commands
SqlClient: Total # failed connections

But these counters most of the time fails to work .  And I could not find any other client side counter that always works . 

2> SQL Server Performance Counter

SQLServer:General Statistics
Logins/sec
Logouts/sec
User Connections

Figure 1

If we take a perfmon with the above counter, A lot of logins with a very few or no logouts indicates a connection leak. In my application I set the connection pool size to 5. since my application is leaking connection, you can see at one time its creating a lot of connections or doing a lot of log-ins and not closing any of them. Once the number of connections reached  5 we got the error. and we closed the application. You can see in the perfmon graph above that all the connection were closed when we closed the application. before that there were no log-outs.

3> Profiler

Similar to the perfmon result above , A lot of logins with no logouts indicates a connection leak. In the figure below the “ConnTest” is the name of my application. You need to specify the “Application Name =” in the connection string to get it reflected in the profiler. You will see a lot of logouts once you close the application.

Figure 2           

4> Select * from sysprocesses

Run the command “Select * from sysprocesses” , If you see a lot of entries of you application in the result set its quite possible that your application is leaking connection.

Once you close your application , You won’t find any such entries in the result set.

Figure 3

If you are using Oracle as your database you can sunstitute this command with

SELECT LOGON_TIME, OSUSER, PROCESS, MACHINE, PROGRAM
FROM V$SESSION WHERE PROGRAM IS NOT NULL

5> Running out of port

If your application is leaking connection, It will keep on opening connection without closing them. For opening each connection it will use a port. at one time it might happen that the application box might run out of port. You can track that by the command  “Netstat –aon” from the command prompt. If you see a lot of “Time_Wait” in the netstat output , this means that the client box is running out of port. The permanent solution for Connection Leak is always fixing the code. But If you really running out of ports a temporary fix would be to increase the no of ephemeral ports. Ephemeral ports are ports that are used for mainly temporary purpose for opening short lived connection. The no of ephemeral ports varies from 1024 to 65534  To increase the no of ephemeral ports

Ephemeral ports are ports that are used for mainly temporary purpose for opening short lived connection. we need to change the following registry entries

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

On the Edit menu, click New, and then add the following registry entry:
Value Name: MaxUserPort
Value Type: DWORD
Value data: 65534
Valid Range: 5000-65534 (decimal)
Default: 0x1388 (5000 decimal)

We need to increase the value to a higher one eg 65534.

Another fix for a lot of time_wait is adjusting the TcpTimedwaitDelay in the registry. This value indicates the amount of time a port will remain in Time_wait state if you do not close the connection. If you decrease this value, the port will be in time_wait state for less amount of time and will be reused sooner.

This key is located at -:

HKEY_LOCAL_MACHINE\System\CurrectControlSet\services\Tcpip\Parameters
The registry value is:

TcpTimedWaitDelay

Key: Tcpip\Parameters
Value Type: REG_DWORD - Time in seconds
Valid Range: 30-300 (decimal)
Default: 0xF0 (240 decimal)

We need to decrease this value to a lower one eg 30.

NOTE- PLEASE TAKE A COMPLETE BACKUP OF THE BOX BEFORE MAKING ANY CHANGES AND ALSO RESTART THE BOX AFTER CHANGING THE REGISTRY 

For example if you run netstat -aon and you see that close to 4000 connections to the IP address of the target computer that is running SQL Server are in a TIME_WAIT state, you can both increase the default MaxUserPort setting and reduce the TcpTimedWaitDelay setting so that you do not run out of client anonymous ports. For example, you can set the MaxUserPort setting to 20000 and set the TcpTimedWaitDelay setting to 30. A lower TcpTimedWaitDelay setting means that the sockets wait in the TIME_WAIT state for less time. A higher MaxUserPort setting means that you can have more sockets in the TIME_WAIT state.

To know more about MaxUserPort and TcpTimedWaitDelay please refer to  https://support.microsoft.com/kb/328476

This is quite typical in applications that leak connections. In some cases, this error only occurs when the customer has migrated a web application from the test environment to the production environment. This is typically because the test server has less memory and garbage collection is run often enough to clean up the leaked connections. In the production environment, the server typically has 2-4 times as much memory as in the test environment, thus there is little memory pressure on the machine to force a garbage collection.

Short time fix for connection leak

The parmanent solution for connection leak is always to fix the code. But What if you discovered the connection pooling issue in production and you cannot take it offline to troubleshoot? Turn pooling off. Even though your app will take a performance hit, it shouldn't crash! Your memory footprint will also grow. What if it doesn't crash all that often, and you don't want to take a performance hit? Try this:

conn = new SqlConnection();
try
{
  conn.ConnectionString = "integrated security=SSPI;SERVER=YOUR_SERVER;DATABASE=YOUR_DB_NAME;Min Pool Size=5;Max Pool Size=60;Connect Timeout=2;";     // Notice Connection Timeout set to only two seconds!
  conn.Open();
}
catch(Exception)
{
  if (conn.State != ConnectionState.Closed) conn.Close();
  conn.ConnectionString = "integrated security=SSPI;SERVER=YOUR_SERVER;DATABASE=YOUR_DB_NAME;Pooling=false;Connect Timeout=45;";
  conn.Open();
}

If I fail to open a pooled connection within two seconds, I am trying to open a non-pooled connection. This introduces a two second delay when no pooled connections are available, but if your connection leak doesn't show most of the time, this is a good steam valve.

To Know more about connection pooling please visit the following websites

https://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;191572

https://support.microsoft.com/kb/313480/en-us

https://msdn.microsoft.com/en-us/library/ms810829.aspx

https://msdn.microsoft.com/en-us/library/aa175863(SQL.80).aspx

https://msdn.microsoft.com/en-us/library/ms810810.aspx

https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlconnection.connectionstring.aspx

1)SqlNotificationRequest
2)SqlDependency
3)SqlCacheDependency

Actually the feature in SQL 2005 that delivers notifications on subscriptions for data changes is called Query Notifications

Clients can submit a query requesting to be notified when data was modified in a manner that would change the query result and the server sends a notification when this change occurs. These requests are called ‘query notification subscriptions’.
The list of notification subscriptions can be seen in the server level view sys.dm_qn_subscriptions:
 

select * from sys.dm_qn_subscriptions

whhen you submit a query for the notification, the client submits a service name and a broker instance. Each notification subscription begins a Service Broker dialog with this provided service and broker instance. When data is changed and the change would affect the result of the submitted query result, a message is sent on this dialog. By sending this message, the client is considered notified and the notification subscription is removed. If client desires to be notified on further changes, is supposed to subscribe again.

1) SqlNotificationRequest
This is simplest ADO.Net component for subscribing to Query Notifications. This class is used directly to create a query notifications subscription. It consists of three steps -

-         Create a new SqlNotificationRequest object, passing in the appropriate Service Broker service name and broker instance

-         Assign the newly created SqlNotificationRequest to the Notification property of a SqlCommand

-         Execute the SqlCommand.

2)SqlDependency
This component tries to make the task of handling the Query Notification subscription messages as straightforward as possible. Using the SqlDependency the application developer gets a CLR callback whenever data has changed.

3) SqlCacheDependency
This is a component designed specifically for ASP.Net to cache data, using the SqlDependency whenever possible.This is just another implementation of the SQL dependency.

Common ERRORs of SQL Broker service

2007-10-12 11:18:32.44 spid25s The query notification dialog on conversation handle ‘{EC54573A-9978-DC11-961C-00188B111155}.’ closed due to the following error: ‘<?xml version=”1.0″?><Error xmlns=”https://schemas.microsoft.com/SQL/ServiceBroker/Error”><Code>-8490</Code><Description>Cannot find the remote service ‘SqlQueryNotificationService-4869b411-fa1c-4d8a-ab37-5bf5762eb98b’ because it does not exist.</Description></Error>’

Reason:

The application is supposed to invoke the static method SqlDependency.
Start  at startup to deploy the necessary infrastructure, then use instances of SqlDependency  object associated with a SqlCommand to receive callbacks when the query executed is notified (data has changed), and finally call SqlDependency.Stop  when the application shuts down to tear down the infrastructure deployed at startup.

The error happens in the following scenario:
1) SqlDependency.Start () is invoked by an application. At this moment a service, a queue and a procedure are created.
2) SqlDependency is used to subscribe to query notifications. Perhaps some queries are notified and re-subscribed, in a normal operations mode
3) Application exists, SqlDependency.Stop is called and the service, queue and procedure are dropped. However, there are still subscribed notifications pending on the server.
4) One or more of the pending subscriptions are notified in the server. This cause a notification message to be sent, but the destination service was dropped, so an error is returned to the sender. The QN receives this error and displays an error message in the ERRORLOG:

A possible workaround would probably have to be based on the kill query notification subscription verb, forcing the application to cleanup any pending subscription at shutdown. Refer to your BOL for more information.

Note -  sqlcmd uses OLE DB while Query analyzer and osql uses ODBC ..