How to track SQL Server crash audit events?

Question

I recently took control of a Windows 2003 server. The application log is populated with the following messages:

Event Type: Failure Audit
Event Source: MSSQLSERVER
Event Category: (4)
Event ID: 18456
Date:  3/5/2010
Time:  4:00:30 PM
User:  N/A
Computer: FAIROAKS1
Description:
Login failed for user 'administrator'. [CLIENT: <local machine>]
Data:
0000: 18 48 00 00 0e 00 00 00   .H......
0008: 0a 00 00 00 46 00 41 00   ....F.A.
0010: 49 00 52 00 4f 00 41 00   I.R.O.A.
0018: 4b 00 53 00 31 00 00 00   K.S.1...
0020: 07 00 00 00 6d 00 61 00   ....m.a.
0028: 73 00 74 00 65 00 72 00   s.t.e.r.
0030: 00 00                     ..      

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I would like to find out which program calls them. Is there a way to track and figure out which process is causing these errors?

Answer 1

This is because some account cannot connect to the instance of SQL Server installed on this server.

The above message means that there is an SQL login (not Windows Auth) called an “administrator” that is not configured in sys.server_principals or an invalid password.

, SQL-, , . . .

, : . , SQL Server, ...: -)