SQL Server 2012的默认扩展事件中出现大量security_error_ring_buffer_recorded

aohan 2018-05-16 05:48:59
SQL Server 2012的默认扩展事件中出现大量security_error_ring_buffer_recorded
不知道是什么原因引起的,日志中未查到与登录有关的错误信息。


...全文
1342 6 打赏 收藏 举报
写回复
6 条回复
切换为时间正序
当前发帖距今超过3年,不再开放新的回复
发表回复
aohan 2018-05-21
引用 4 楼 zjcxc 的回复:
另外,查查具体的数据是些啥
SELECT CONVERT (VARCHAR (30), GETDATE(), 121) AS runtime,
       dateadd(ms, (a.[Record Time] - sys.ms_ticks), GETDATE()) AS [Notification_Time],
       a.*,
       sys.ms_ticks AS [Current Time]
FROM (SELECT x.value('(//Record/Error/ErrorCode)[1]', 'varchar(30)') AS [ErrorCode],
             x.value('(//Record/Error/CallingAPIName)[1]', 'varchar(255)') AS [CallingAPIName],
             x.value('(//Record/Error/APIName)[1]', 'varchar(255)') AS [APIName],
             x.value('(//Record/Error/SPID)[1]', 'int') AS [SPID],
             x.value('(//Record/@id)[1]', 'bigint') AS [Record Id],
             x.value('(//Record/@type)[1]', 'varchar(30)') AS [Type],
             x.value('(//Record/@time)[1]', 'bigint') AS [Record Time]
      FROM (SELECT CAST (record AS XML)
            FROM sys.dm_os_ring_buffers
            WHERE ring_buffer_type = 'RING_BUFFER_SECURITY_ERROR') AS R(x)) AS a CROSS JOIN sys.dm_os_sys_info AS sys
ORDER BY a.[Record Time] ASC;

这个我之前也查过,没有什么发现,网上资料也查过很多,好像都没有比较深入的分析,目前也只能采取不理会的措施,本来想根据那个Sessionid查点什么信息的,可是也找不到什么线索,暂时只能先不管它了。
  • 打赏
  • 举报
回复
zjcxc 2018-05-18
  <Error>
    <SPID>161</SPID>
    <APIName>ImpersonateSecurityContext</APIName>
    <CallingAPIName>NLShimImpersonate</CallingAPIName>
    <ErrorCode>0x139F</ErrorCode>
    <SQLErrorCode>x_cse_Success</SQLErrorCode>
  </Error>
如果基本上都是类似这样的东东,那么忽略吧 SQLErrorCode = x_cse_Success 看起来应该是成功的信息,没搞懂为什么会大量记录,网上搜索也无果,2014 也会有大量的这种记录
  • 打赏
  • 举报
回复
zjcxc 2018-05-18
另外,查查具体的数据是些啥
SELECT CONVERT (VARCHAR (30), GETDATE(), 121) AS runtime,
       dateadd(ms, (a.[Record Time] - sys.ms_ticks), GETDATE()) AS [Notification_Time],
       a.*,
       sys.ms_ticks AS [Current Time]
FROM (SELECT x.value('(//Record/Error/ErrorCode)[1]', 'varchar(30)') AS [ErrorCode],
             x.value('(//Record/Error/CallingAPIName)[1]', 'varchar(255)') AS [CallingAPIName],
             x.value('(//Record/Error/APIName)[1]', 'varchar(255)') AS [APIName],
             x.value('(//Record/Error/SPID)[1]', 'int') AS [SPID],
             x.value('(//Record/@id)[1]', 'bigint') AS [Record Id],
             x.value('(//Record/@type)[1]', 'varchar(30)') AS [Type],
             x.value('(//Record/@time)[1]', 'bigint') AS [Record Time]
      FROM (SELECT CAST (record AS XML)
            FROM sys.dm_os_ring_buffers
            WHERE ring_buffer_type = 'RING_BUFFER_SECURITY_ERROR') AS R(x)) AS a CROSS JOIN sys.dm_os_sys_info AS sys
ORDER BY a.[Record Time] ASC;

  • 打赏
  • 举报
回复
zjcxc 2018-05-18
你查的是操作系统的日志,还是 SQL Server 的日志?
  • 打赏
  • 举报
回复
aohan 2018-05-17
我上面已经注明了,没有与登录有关的安全日志出现。
  • 打赏
  • 举报
回复
OwenZeng_DBA 2018-05-17
检查下错误日志,看看有没有很多安全相关的日志。比如登录失败
  • 打赏
  • 举报
回复
相关推荐
发帖
疑难问题
加入

2.1w+

社区成员

MS-SQL Server 疑难问题
申请成为版主
帖子事件
创建了帖子
2018-05-16 05:48
社区公告
暂无公告