error message not being logged to windows event log

Hi,
I am trying to get a message (#18453 - Login succeeded for use '%ls%'. Conn
ection: Trusted) to the windows event log. It's severity is 14 and it is al
ready checked off as a logged event, but it is not being logged. Is this a
bug or is there something e
lse I need to configure?
Regards
ALogin messages are handled differently in terms of
configuring with sp_altermessage. To log all of your logins
to the event log, open Enterprise Manager, right click on
the server and select properties. On the security tab, set
the audit level to all. This will log success and failed
logins to the event log.
-Sue
On Sun, 21 Mar 2004 11:06:07 -0800, "anon"
<anonymous@.discussions.microsoft.com> wrote:

>Hi,
>I am trying to get a message (#18453 - Login succeeded for use '%ls%'. Connection:
Trusted) to the windows event log. It's severity is 14 and it is already checked o
ff as a logged event, but it is not being logged. Is this a bug or is there somethi
ng
else I need to configure?
>Regards
>A|||Hi Sue,
I have done that but still it is not being logged. My log in consists of me
opening a new window in Query Analyzer and logging in with a SQL Server log
in and password, not through Windows authentication, though I don't think th
is would matter...
Is there anything I'm missing here?
Regards,
A|||Did you restart SQL Server after changing the audit logins
setting?
-Sue
On Mon, 22 Mar 2004 15:46:08 -0800, "anon"
<anonymous@.discussions.microsoft.com> wrote:

>Hi Sue,
>I have done that but still it is not being logged. My log in consists of m
e opening a new window in Query Analyzer and logging in with a SQL Server lo
gin and password, not through Windows authentication, though I don't think t
his would matter...
>Is there anything I'm missing here?
>Regards,
>A|||Thank you Sue. That worked.|||Sue Hoegemeier <Sue_H@.nomail.please> wrote:
> On Mon, 22 Mar 2004 15:46:08 -0800, "anon"
> <anonymous@.discussions.microsoft.com> wrote:
I'm no expert in SQL/MSDE, far from it. But from what I've (remembered of
what) I've read, I thought the login audit logging only went to file
LOGS\ERRORLOG and not to the Event Log.
Anyway that's the behaviour I see here: AuditLevel=3 and I get entries in
the ERRORLOG but nothing apparent in the Event Log. I'm not using SQL
authentication so the entries are of the form:
2004-03-19 21:39:25.81 logon Login succeeded for user 'DOM\usr'.
Connection: Trusted.
and if I try sa not using the correct password I get:
2004-03-23 16:33:57.51 logon Login failed for user 'sa'.
I may well be wrong on the non logging to the Event Log...but check the
contents of ERRORLOG anyway to see if the logging is occuring there.
> Did you restart SQL Server after changing the audit logins
> setting?
>
Or maybe that has solved it already...
--
Alan J. McFarlane
http://homepage.ntlworld.com/alanjmcf/
Please follow-up in the newsgroup for the benefit of all.|||Anon restarted SQL Server after making the changes which
solved the problem.
Logging to the Windows event log is enabled by default for
SQL Server. The auditing is logged to the SQL Server error
log and the Windows Application event log if you haven't
changed the default settings. You can find more information
on this in books online under startup options.
-Sue
On Tue, 23 Mar 2004 16:44:50 -0000, "Alan J. McFarlane"
<alanjmcf@.yahoo.com.INVALID> wrote:

>Sue Hoegemeier <Sue_H@.nomail.please> wrote:
>I'm no expert in SQL/MSDE, far from it. But from what I've (remembered of
>what) I've read, I thought the login audit logging only went to file
>LOGS\ERRORLOG and not to the Event Log.
>Anyway that's the behaviour I see here: AuditLevel=3 and I get entries in
>the ERRORLOG but nothing apparent in the Event Log. I'm not using SQL
>authentication so the entries are of the form:
> 2004-03-19 21:39:25.81 logon Login succeeded for user 'DOM\usr'.
>Connection: Trusted.
>and if I try sa not using the correct password I get:
> 2004-03-23 16:33:57.51 logon Login failed for user 'sa'.
>I may well be wrong on the non logging to the Event Log...but check the
>contents of ERRORLOG anyway to see if the logging is occuring there.
>
>Or maybe that has solved it already...|||Sue Hoegemeier <Sue_H@.nomail.please> wrote:
> Anon restarted SQL Server after making the changes which
> solved the problem.
> Logging to the Windows event log is enabled by default for
> SQL Server. The auditing is logged to the SQL Server error
> log and the Windows Application event log if you haven't
> changed the default settings. You can find more information
> on this in books online under startup options.
>
Ah ha, shows that I truly don't know much on this subject.
Interestingly my MSDE appears to be started with -sINSTANCE
and -d... -e... -l..., but no -n, hmm. I think I better talk to the folks
who created the installer for it, to see what odd way they have configured
it...
--
Alan J. McFarlane
http://homepage.ntlworld.com/alanjmcf/
Please follow-up in the newsgroup for the benefit of all.|||One other thought...are any events from anything being
logged to your application event log? Could be that your log
has a max size with no overwriting and it is filled up. You
could try manually clearing the log and see if that makes a
difference as well.
-Sue
On Wed, 24 Mar 2004 11:59:17 -0000, "Alan J. McFarlane"
<alanjmcf@.yahoo.com.INVALID> wrote:

>Sue Hoegemeier <Sue_H@.nomail.please> wrote:
>Ah ha, shows that I truly don't know much on this subject.
>Interestingly my MSDE appears to be started with -sINSTANCE
>and -d... -e... -l..., but no -n, hmm. I think I better talk to the folks
>who created the installer for it, to see what odd way they have configured
>it...|||Sue Hoegemeier <Sue_H@.nomail.please> wrote:
> On Tue, 23 Mar 2004 16:44:50 -0000, "Alan J. McFarlane"
> <alanjmcf@.yahoo.com.INVALID> wrote:
I've had a look back through the documents I had read, to see what gave me
this impression.
In http://msdn.microsoft.com/library/e.../SecNetch13.asp
there is no mention of the logging going to the Event Log, only to "SQL log
files". That would be it...
Note, I can see nowhere in the SQL documentation that describes how to set
AuditLevel in the Registry. People will continue to be drawn to that .Net
page to learn how to enable login auditing without using Enterprise Manager
and without working out what SQL-DMO is and how to use it
For instance the only mention of "AuditLevel" in the 'Books Online' index is
a page in the SQL-DMO section.
> Anon restarted SQL Server after making the changes which
> solved the problem.
> Logging to the Windows event log is enabled by default for
> SQL Server. The auditing is logged to the SQL Server error
> log and the Windows Application event log if you haven't
> changed the default settings. You can find more information
> on this in books online under startup options.
>
--
Alan J. McFarlane
http://homepage.ntlworld.com/alanjmcf/
Please follow-up in the newsgroup for the benefit of all.