Next came the question of choosing events. nslookup is a command that can take an IP address as a parameter and tell you the name of the machine: it's like the reverse of the ping command.
And of course there is the question of security - you should want to know why database access is being refused.įrom the frequency of the messages, I knew the request was probably coming from an application or web server, so I ran the following command against the IP addresses to confirm this.
It could also be the default database for the login where explicit permission was not given. The database could be offline, shutdown, deleted, dropped, renamed, auto-closed, or inaccessible for some other reason. As I found out later, States 38 and 40 (in SQL 2008 and later) and States 16 and 27 (before version 2008) mean that there is an issue with the database being connected to. Like other error messages, it also has a State number and there are different State numbers associated with it, each having a different meaning for the failure. Įrror 18456 generally means a failed login attempt.