SQL Server 2012的默认扩展事件中出现大量security_error_ring_buffer_recorded

[aohan]

SQL Server 2012的默认扩展事件中出现大量security_error_ring_buffer_recorded
不知道是什么原因引起的，日志中未查到与登录有关的错误信息。

[OwenZeng_DBA]

检查下错误日志，看看有没有很多安全相关的日志。比如登录失败

[aohan]

我上面已经注明了，没有与登录有关的安全日志出现。

[zjcxc]

你查的是操作系统的日志，还是 SQL Server 的日志？

[zjcxc]

另外，查查具体的数据是些啥

SELECT CONVERT (VARCHAR (30), GETDATE(), 121) AS runtime,
       dateadd(ms, (a.[Record Time] - sys.ms_ticks), GETDATE()) AS [Notification_Time],
       a.*,
       sys.ms_ticks AS [Current Time]
FROM (SELECT x.value('(//Record/Error/ErrorCode)[1]', 'varchar(30)') AS [ErrorCode],
             x.value('(//Record/Error/CallingAPIName)[1]', 'varchar(255)') AS [CallingAPIName],
             x.value('(//Record/Error/APIName)[1]', 'varchar(255)') AS [APIName],
             x.value('(//Record/Error/SPID)[1]', 'int') AS [SPID],
             x.value('(//Record/@id)[1]', 'bigint') AS [Record Id],
             x.value('(//Record/@type)[1]', 'varchar(30)') AS [Type],
             x.value('(//Record/@time)[1]', 'bigint') AS [Record Time]
      FROM (SELECT CAST (record AS XML)
            FROM sys.dm_os_ring_buffers
            WHERE ring_buffer_type = 'RING_BUFFER_SECURITY_ERROR') AS R(x)) AS a CROSS JOIN sys.dm_os_sys_info AS sys
ORDER BY a.[Record Time] ASC;

[zjcxc]

  <Error>
    <SPID>161</SPID>
    <APIName>ImpersonateSecurityContext</APIName>
    <CallingAPIName>NLShimImpersonate</CallingAPIName>
    <ErrorCode>0x139F</ErrorCode>
    <SQLErrorCode>x_cse_Success</SQLErrorCode>
  </Error>

如果基本上都是类似这样的东东，那么忽略吧 SQLErrorCode = x_cse_Success 看起来应该是成功的信息，没搞懂为什么会大量记录，网上搜索也无果，2014 也会有大量的这种记录

[aohan]

引用 4 楼 zjcxc 的回复:

另外，查查具体的数据是些啥

SELECT CONVERT (VARCHAR (30), GETDATE(), 121) AS runtime,
       dateadd(ms, (a.[Record Time] - sys.ms_ticks), GETDATE()) AS [Notification_Time],
       a.*,
       sys.ms_ticks AS [Current Time]
FROM (SELECT x.value('(//Record/Error/ErrorCode)[1]', 'varchar(30)') AS [ErrorCode],
             x.value('(//Record/Error/CallingAPIName)[1]', 'varchar(255)') AS [CallingAPIName],
             x.value('(//Record/Error/APIName)[1]', 'varchar(255)') AS [APIName],
             x.value('(//Record/Error/SPID)[1]', 'int') AS [SPID],
             x.value('(//Record/@id)[1]', 'bigint') AS [Record Id],
             x.value('(//Record/@type)[1]', 'varchar(30)') AS [Type],
             x.value('(//Record/@time)[1]', 'bigint') AS [Record Time]
      FROM (SELECT CAST (record AS XML)
            FROM sys.dm_os_ring_buffers
            WHERE ring_buffer_type = 'RING_BUFFER_SECURITY_ERROR') AS R(x)) AS a CROSS JOIN sys.dm_os_sys_info AS sys
ORDER BY a.[Record Time] ASC;

这个我之前也查过，没有什么发现，网上资料也查过很多，好像都没有比较深入的分析，目前也只能采取不理会的措施，本来想根据那个Sessionid查点什么信息的，可是也找不到什么线索，暂时只能先不管它了。