Certainly looks like a hack.
Run profiler for a while, capture the audit login failure event and log the
host name. Maybe you can find out where the logins are coming from.
I'd also suggest you make sure your sa password is strong.
--
Gail Shaw (MCDBA, MCTS SQL 2005)
http://gail.rucus.net/ [quoted text, click to view] "Sajith" wrote:
> Hi all,
>
> I have these lines repeated many times, every 1 second, in the error log:
>
> Login failed for user 'user'
> Login failed for user 'sa'
> Login failed for user 'root'
> Login failed for user 'admin'
>
> Is someone trying to hack my SQL server (version is 2000)?
>
>
> How can I control and stop these logins?
>
> Thank you
>
[quoted text, click to view] > Is someone trying to hack my SQL server (version is 2000)?
It certainly look that way!
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp http://sqlblog.com/blogs/tibor_karaszi [quoted text, click to view] "Sajith" <Sajith@discussions.microsoft.com> wrote in message
news:77FE5A1B-A851-4D06-A3F1-CB2084271EB8@microsoft.com...
> Hi all,
>
> I have these lines repeated many times, every 1 second, in the error log:
>
> Login failed for user 'user'
> Login failed for user 'sa'
> Login failed for user 'root'
> Login failed for user 'admin'
>
> Is someone trying to hack my SQL server (version is 2000)?
>
>
> How can I control and stop these logins?
>
> Thank you
>
> Sajith
Don't see what you're looking for? Try a search.