Failure Audit message in SQL Server – Event ID: 18456 every minute?

This is a event log error I have seen in Project Server 2007 on various farms going right back to the Beta and I finally found some time to track it down.  It didn't seem to be breaking anything on my server, but made it difficult to read the logs and see other "important" stuff.  This is the error:

Event Type:    Failure Audit
Event Source:    MSSQLSERVER
Event Category:    (4)
Event ID:    18456
Date:        1/17/2008
Time:        1:29:00 PM
User:        DOMAIN\User
Computer:    SERVERNAME
Login failed for user 'DOMAIN\user'. [CLIENT: <local machine>]

I did a SQL Profiler trace to see where it was coming from and discovered the cause was a SQL Server Agent job called SharedServices_DB_Job_DeleteExpiredSessions that was running every minute.  The reason for the failure was that I did not have a SharedServices_DB on that server.  I did once - but my test server gets changed around a fair bit and this was a remnant that didn't get cleaned up. Not sure if it would normally get removed and if I did something bad which left it hanging around. 

This could also happen with Microsoft Office SharePoint Server 2007 even if Project isn't installed as it relates to the Shared Services Provider.  To disable the job you can go to SQL Management Studio, and connect to your database engine, then expand SQL Server Agent - select the Disable option. 


There will likely be other valid jobs there too - for your real SharedServices databases that still exist.  The bad one will show that it has failed when last executed if you look in the Job Activity Monitor.


Not a big problem - but at least disabling will keep the logs looking clean, and will save a few CPU cycles for some real work.

Technorati Tags: Project Server 2007

Comments (10)

  1. Robby D says:

    Great tip! I found that I had recreated an SSP in SharePoint and deleted the old SSP databases. I saw many Failure Audits coming in every minute. Disabling the Job stopped the errors.

  2. Rob says:

    Sweet! Thank you for your help, This was causing some annoyances and now is cleared up…

  3. Jess Kung says:

    This is great tips and helped  our problem in the similar situation.

    Keep up th egood work

  4. bob e says:

    Yes my friend.  

    Thanks, you have saved me lot of aggrevation.  I was getting the same heinous error every 15 minutes in my otherwise pristine log.

  5. Mark says:

    Thanks, that was quite helpfull

  6. Rene says:

    Thnx, This has been a thorn in my side for quite some time now.

    This solved it.

  7. Claudia says:

    Thank you! It solved my problem.

  8. Tom Godbold says:

    Thanks Brian! This came in handy.

  9. James Ellinwood says:

    Brian I had the same error, except it is my “NT Authoritysystem” account.   I followed your steps, very thorough.  But my SQL Server Agents are running under one of my domain service accounts and I have no jobs running against a non-existent database. I ran a trace in the sql profiler and did not see anything. Do you have any suggestions.


  10. Duncan says:

    Thanks so much for this tip its saved me a lot of head scratching

Skip to main content