Comments on: SQL SERVER – Interesting Observation of Logon Trigger On All Servers http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/ Personal Notes of Pinal Dave Sat, 25 May 2013 15:33:52 +0000 hourly 1 http://wordpress.com/ By: Biny http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-462514 Wed, 24 Apr 2013 02:20:29 +0000 http://blog.sqlauthority.com/?p=5185#comment-462514 I run into similar issue actually I had a stored procedure that was called from within such similar trigger and my mail box (received it in my Gmail account) was filled up by that same message about security warning any help or findings pls

]]> By: Monica Pepe http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-384364 Sat, 01 Dec 2012 01:10:07 +0000 http://blog.sqlauthority.com/?p=5185#comment-384364 Hi Pinal,

2 questions….

1) Where is this trigger stored? On the serverlogonhistory table?

2) I suspect I can put a “where clause” in the trigger create script, such as…

WHERE System_User not in (‘sa’, ‘_SYSADMIN_’, ‘mydomain\myusername’)

My goal is to capture only the logons for the application that runs on top of sql and not the logins by our service accounts, sqlreporting services, management studio connections, etc. I would also store the logon table not in a separate db but in the sql db associated to the application that we use.

Please advise.

Monica

]]> By: Nick Holt http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-355962 Thu, 04 Oct 2012 21:16:43 +0000 http://blog.sqlauthority.com/?p=5185#comment-355962 In fact I can’t even log in as sa, because I get the same error. This is a disaster. I’m going to have to uninstall and reinstall SQL Server on my machine. Thanks for nothing PD.

]]> By: Nick Holt http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-355961 Thu, 04 Oct 2012 21:10:44 +0000 http://blog.sqlauthority.com/?p=5185#comment-355961 I ran your code, but now I can’t logon to SQL Server> I get the message ‘Cannot connect to Nick-PC\SQL.
Additional Information:
Login failed for login ‘Nick-PC\Nick’ due to trigger execution.
Changed database context to master.
Changed language setting to us_english. (Microsoft SQL Server, Error, 17892)

How do I log into SQL Server to fix this?

]]> By: jagan http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-326514 Tue, 07 Aug 2012 13:10:18 +0000 http://blog.sqlauthority.com/?p=5185#comment-326514 hi pinal,
i have a question regarding putting session time limit on users connecting to the database in sql server 2000, how do i implement it using logon triggers or with any other way?

]]> By: SQL SERVER – Significance of Various Kinds of Triggers- Quiz – Puzzle – 2 of 31 « SQL Server Journey with SQL Authority http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-230361 Tue, 03 Jan 2012 01:31:30 +0000 http://blog.sqlauthority.com/?p=5185#comment-230361 [...] and Explanation Disable All Triggers on a Database – Disable All Triggers on All Servers Interesting Observation of Logon Trigger On All Servers Disable Triggers – [...]

]]> By: Neeta Chander http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-186834 Wed, 02 Nov 2011 06:57:39 +0000 http://blog.sqlauthority.com/?p=5185#comment-186834 The same error also comes even if the database has not been dropped. This comes when you login with Windows authetication and occurs if the user does not have permission over AuditDB database to execute the trigger. Solution for this is to create Trigger with Execute as sa clause
i.e.
CREATE TRIGGER Tr_ServerLogon
ON ALL SERVER WITH Execute As ‘sa’ FOR LOGON
AS
BEGIN
INSERT INTO AuditDb.dbo.ServerLogonHistory
SELECT SYSTEM_USER,USER,@@SPID,GETDATE()
END
GO

]]> By: Ritesh Kumar http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-146887 Fri, 08 Jul 2011 12:52:21 +0000 http://blog.sqlauthority.com/?p=5185#comment-146887 Hi,
I was facing same problem.
When I have inserted ORIGINAL_DB_NAME() in ServerLogonHistory table I observed in my cases It is happening due to other applications like report sever etc. is also accessing the sql server. When I stopped those services which solved my problem. Logon trigger fires when new session is established (For example when we open a new query page due to its execute USE YourDb) .
To stop such entry we can write :

SELECT SYSTEM_USER,USER,@@SPID,GETDATE() WHERE ORIGINAL_DB_NAME() = ”

]]> By: Oskar Gunn http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-98848 Wed, 10 Nov 2010 11:21:55 +0000 http://blog.sqlauthority.com/?p=5185#comment-98848 Hi,

I´ve been trying your logon trigger on SQL2K5. It seems to work when I log on with Windows Authentication but logon fails with SQL Server Authentication…. for all users except sa.

I see that you tested sq auth for sa, have you also tried for a normal user? :/

( I get Error: 17892 )

]]> By: Joaqiuin http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-98083 Fri, 05 Nov 2010 21:22:31 +0000 http://blog.sqlauthority.com/?p=5185#comment-98083 Hey Men,

Thx for the Help us

All work Ok

Greating from Lima . Peru

]]> By: Kareem http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-85194 Wed, 25 Aug 2010 08:00:24 +0000 http://blog.sqlauthority.com/?p=5185#comment-85194 Hii,

In the similar way..

Can any one please let me know the process that how can we create trigger so that it grab the job failure logs when the job fails and that error log details will sends to mail via SMTP.

I am using SQL 2000.

Please provide some URL’s for this task is much helpfull for me.

Thanks in Advance.
Kareem.

]]> By: Fadi http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-82840 Tue, 03 Aug 2010 10:07:30 +0000 http://blog.sqlauthority.com/?p=5185#comment-82840 I copied the code and pasted it in the SQL2005 but i got this error message

Msg 1084, Level 15, State 1, Procedure Tr_ServerLogon, Line 3
‘LOGON’ is an invalid event type.

]]> By: Greg http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-61800 Thu, 25 Feb 2010 23:56:37 +0000 http://blog.sqlauthority.com/?p=5185#comment-61800 This is excellent, but it doesnt log failed logon attempts how can I log failed logon’s

…

The login trigger only fires after successful authentication to the server. For failed logins, you still have to rely on SQL Server auditing.

]]> By: Paul http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-61328 Wed, 17 Feb 2010 10:49:07 +0000 http://blog.sqlauthority.com/?p=5185#comment-61328 This is excellent, but it doesnt log failed logon attempts how can I log failed logon’s

eg

INSERT INTO AuditDb.dbo.ServerLogonHistory
SELECT SYSTEM_USER, HOST_NAME(),USER, @@SPID, GETDATE(), APP_NAME(), DB_NAME()
END

]]> By: Greg hilsheimer http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-60005 Wed, 20 Jan 2010 16:35:07 +0000 http://blog.sqlauthority.com/?p=5185#comment-60005 Re:multiple trigger events
We are getting a logon trigger event fired on a .Net connection with pooling on for a simple query.

If I do not do a query it only fires once, pooling is working
but if execute an sql statement on connection for example:

“SELECT 1″ an perform a .Net Execute scalar the trigger is fired.

The spids are always the same.

If take query out and open an close connection with same connection string, event is only fired once

]]> By: SQL SERVER – Fix : Error : 17892 Logon failed for login due to trigger execution. Changed database context to ‘master’. Journey to SQL Authority with Pinal Dave http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-53284 Sat, 27 Jun 2009 07:20:01 +0000 http://blog.sqlauthority.com/?p=5185#comment-53284 [...] SQL SERVER – Interesting Observation of Logon Trigger On All Servers [...]

]]> By: SQL SERVER – Interesting Observation of Logon Trigger On All Servers – Solution Journey to SQL Authority with Pinal Dave http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-53266 Fri, 26 Jun 2009 01:31:22 +0000 http://blog.sqlauthority.com/?p=5185#comment-53266 [...] an article on my interesting observation regarding logon triggers. I would advise you to first read SQL SERVER – Interesting Observation of Logon Trigger On All Servers before continuing with this article further to have a complete idea of the [...]

]]> By: sriki http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52539 Fri, 29 May 2009 14:54:52 +0000 http://blog.sqlauthority.com/?p=5185#comment-52539 Hi Simon,

Thanks for info. Pardon my ignorance. I now disabled SSIS/SSRS/SSAS/SQL Agent and as far as I know there is no app using my instance of SQL. But, I still see multiple entries in the table(even for the time when I am not logged into SSMS. Am I missing anything else??

Sriki

]]> By: Simon Worth http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52516 Thu, 28 May 2009 15:41:32 +0000 http://blog.sqlauthority.com/?p=5185#comment-52516 Sriki
If you have the SQL agent running it will show up in the table as well. If reporting services is running it will show up a ton of times in the table too. Any services and applications you have running on the machine or remote apps and services that use your SQL Server instance will all show up. I find Reporting Services to be the biggest though, generally logging in every minute – and therefore adding an another entry into the table. Even if you refresh an open table in Management studio, that counts as another login and adds another record to the table. Jobs that run add records, as well as clean up tasks. You’d be surprised how much activity is going on behind the scenes when you are doing nothing with SQL Server.

]]> By: reena trikha http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52487 Wed, 27 May 2009 15:10:02 +0000 http://blog.sqlauthority.com/?p=5185#comment-52487 Dear Mr. Dave
I tried the above mentioned code in my Sql Server @005. But I am getting this error
logon is an invalid event type

I need to know the reason
Thanks
Reena

]]> By: sriki http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52486 Wed, 27 May 2009 14:52:08 +0000 http://blog.sqlauthority.com/?p=5185#comment-52486 Another update.

I deleted all the data from the ServerLogonHistory table and was doing some other stuff(non-sql). When I logged back into SSMS, I saw a lot entries with timestamps of the time when I was working on something else or infact doing nothing. This is clearly not an issue related to connections to Object Explorer, Intellisense, and query window as Simon mention. Anybody wants to chip in. I am stumped.

]]> By: Marcos http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52484 Wed, 27 May 2009 14:30:43 +0000 http://blog.sqlauthority.com/?p=5185#comment-52484 I add APP_NAME() and it shows me connecting to Management Studio and also when I opened a query window, as a result, multiple entries added to my table. Thanks for the challenge, very interesting.

]]> By: Jeremy Lowell http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52483 Wed, 27 May 2009 14:23:22 +0000 http://blog.sqlauthority.com/?p=5185#comment-52483 Pinal,

I’ve done this before in a different manner. I created a trace (capture login events), dump to file, load to table, cleanup. Similar behavior; but it’s also expected as there are numerous logins via SSMS, VS, etc… due to the different contexts of the app. I.E. you will authenticate seperatley for server explorer than a query window etc…

In my experience, the auditors loved having this information even though it was overkill in my opinion.

]]> By: Simon Worth http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52482 Wed, 27 May 2009 13:58:35 +0000 http://blog.sqlauthority.com/?p=5185#comment-52482 What you are probably seeing is the connections to Object Explorer, Intellisense, and your query window. These all have their own connections.

]]> By: Argenis Fernandez http://blog.sqlauthority.com/2009/05/27/sql-server-interesting-observation-of-logon-trigger-on-all-servers/#comment-52478 Wed, 27 May 2009 12:24:57 +0000 http://blog.sqlauthority.com/?p=5185#comment-52478 Pinal,

Maybe Intellisense is to blame for the additional logons…you can extend the logon trigger to include APP_NAME()

Regards,

Argenis

]]>