FIX: Alerts Triggered Incorrectly When Security Auditing is Enabled

This article was previously published under Q288426
This article has been archived. It is offered "as is" and will no longer be updated.
BUG #: 352091 (Shiloh_bugs)
BUG #: 101254 (SQLBUG_70)
SYMPTOMS
By default, Security Auditing informational messages have a severity of 14. However, after you set up Security Auditing on the server, you may encounter a scenario where Security Auditing informational messages raise alerts with a variety of severity levels. The alerts may be randomly triggered.
CAUSE
When handling the audit login messages the server incorrectly initializes the severity variable and the latter is a random value.
RESOLUTION

SQL Server 2000

To resolve this problem, obtain the latest service pack for Microsoft SQL Server 2000. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
290211 INF: How to Obtain the Latest SQL Server 2000 Service Pack

Hotfix

NOTE: The following hotfix was created prior to Microsoft SQL Server 2000 Service Pack 1.

The English version of this fix should have the following file attributes or later:
   File name     Size      Time   -------------------------------------------   s70986i.exe   5.07 MB   3/30/2001 11:51 AM				

SQL Server 7.0

To resolve this problem, obtain the latest service pack for Microsoft SQL Server 7.0. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
301511 INF: How to Obtain the Latest SQL Server 7.0 Service Pack
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

SQL Server 2000
This problem was first corrected in Microsoft SQL Server 2000 Service Pack 1.

SQL Server 7.0
This problem was first corrected in Microsoft SQL Server 7.0 Service Pack 4.
MORE INFORMATION
The alerts that occur are determined by what severity-based alerts you have currently defined. By default, SQL Server installs severity-based alerts with a severity ranging from 19 to 24.

An example of a typical Security Auditing information message is:
18454 Login succeeded for user 'Login1'. Connection: Non-Trusted.
-or-
18453 Login succeeded for user 'Domain1\Login2'. Connection: Trusted.
You may see an alert e-mail sent to you that contains the following type of severity information:
Content-Description: SQL Server Alert System: 'Sev. 24 Errors' occurred on     \\SQLSERVERFrom:  alertmail@company.com To:  jsmith@company.comSubject:  SQL Server Alert System: 'Sev. 24 Errors' occurred on \\SQLSERVER Date:  Fri, 19 Jan 2001 09:36:16 -0500 DATE/TIME:	1/19/2001 9:45:10 AMDESCRIPTION:	18454		Login succeeded for user 'Login1'. Connection: Non-Trusted.COMMENT:	SQLSERVERJOB RUN:	(None)					
Properties

Article ID: 288426 - Last Review: 01/16/2015 21:36:35 - Revision: 3.2

Microsoft SQL Server 2000 Standard Edition, Microsoft SQL Server 7.0 Standard Edition

  • kbnosurvey kbarchive kbbug kbfix kbsqlserv2000sp1fix KB288426
Feedback