MOSS event ID 3351 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

11. února 2009 7:07Klemen30

0
Přihlásit se a hlasovat

Hi,

I've got a lot of 3351 events in my event viewer, every day at the same hour (23:00PM, 2:00AM, 16:30PM). I've tried to restart services and web aplication, but it doesn't help.

SQL database login failed. Additional error information from SQL Server is included below.

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

Please help

My log file:

02/11/2009 02:00:04.87 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)     at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)     at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)     at Syste...
02/11/2009 02:00:04.87* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    ...m.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)     at System.Data.ProviderBase.DbConnectionPool.C...
02/11/2009 02:00:04.87* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    ...reateObject(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()
02/11/2009 02:00:04.87 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880j High    SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss'
02/11/2009 02:00:04.87 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      6y64 Critical SQL database login failed. Additional error information from SQL Server is included below. Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High        at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)     at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* overlappedPointer)     at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped...
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High        at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)     at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* overlappedPointer)     at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped...
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High    ...* pOVERLAP)
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880k High    ...* pOVERLAP)
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880l High    ConnectionString: 'Data Source=nero\moss;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False'    ConnectionState: Closed ConnectionTimeout: 15
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880l High    ConnectionString: 'Data Source=nero\moss;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False'    ConnectionState: Closed ConnectionTimeout: 15
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)     at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)     at System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)     at Syste...
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()     at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.SharePoint.Administration.SPConfigurationDat...
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...m.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)     at System.Data.ProviderBase.DbConnectionPool.C...
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...abase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...reateObject(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()     at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand command, CommandBehavior behavior)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.FetchId(QualifiedObjectName qName)     at Microsoft.S...
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()
02/11/2009 02:00:04.89* SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Topology                      888j Medium ...harePoint.Administration.SPConfigurationDatabase.GetObject(String name, Guid parentId, Type type)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.get_Farm()     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.SPFileSystemCacheWatcher.OnChanged(Object source, FileSystemEventArgs e)
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880j High    SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss'
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880i High    System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.     at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)     at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)     at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.SharePoint.Utilities.SqlSession.OpenConnection()
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      6y64 Critical SQL database login failed. Additional error information from SQL Server is included below. Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
02/11/2009 02:00:04.89 SPWRITER.EXE (0x08F4)                   0x0720 Windows SharePoint Services   Database                      880j High    SqlError: 'Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.'    Source: '.Net SqlClient Data Provider' Number: 18456 State: 1 Class: 14 Procedure: '' LineNumber: 65536 Server: 'nero\moss'

tnx

klemen
- Reagovat
- Citovat

Odpovědi

2. března 2009 8:07Klemen30

0
Přihlásit se a hlasovat
Hi, Running Windows sharepoint services vss writer service under AD farm account (instead of Local system) is the solution of my issue! I'm so happy :) Tnx, Klemen
- Označen jako odpověďKlemen30 2. března 2009 8:07
- Reagovat
- Citovat

Všechny reakce

11. února 2009 8:46Madhur AhujaMSFT

0
Přihlásit se a hlasovat
Check if this article from MSDN helps:
http://technet.microsoft.com/en-us/library/cc561068.aspx

--
Madhur

http://blogs.msdn.com/mahuja
- Reagovat
- Citovat
11. února 2009 11:11Klemen30

0
Přihlásit se a hlasovat
Hi,

Service accounts and security rights on databases are OK, in fact everything is working fine, but I want to get rid of 3351 events.... it seems I've got hundreds of them in my event viewer...

tnx
klemen
- Reagovat
- Citovat
11. února 2009 13:47Henrik Halmstrand

0
Přihlásit se a hlasovat
Check this thread, exactly the same:
http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/af528a14-057c-464e-bfd9-4582121d16d0/

Regards
/Henrik
- Reagovat
- Citovat
12. února 2009 7:29Lu Zou-MSFTMSFT, Moderátor

0
Přihlásit se a hlasovat

Hi,

Please check the account name of the application pool of the portal site to see if it is a domain account. If not, reset the application pool account to the domain account to see if it works.

Please let me know if there is any misunderstanding. Thanks!

Lu Zou
- Reagovat
- Citovat
12. února 2009 8:21Klemen30

0
Přihlásit se a hlasovat
Hi,

I've noticed that event 3351 pops up even during backup (STSADM), but backup completed OK.

So, I followed the instructions in thread http://social.technet.microsoft.com/Forums/en-US/sharepointadmin/thread/af528a14-057c-464e-bfd9-4582121d16d0/
and run command line psconfig.exe -cmd secureresources Than I restarted my web front end server and run backup again for test. The event 3351 is not showing durig backup anymore! It's posible that PSCONFIG is the solution... well I'll have to wait till tomorrow morning and check my event viewer. tnx, klemen
- Zrušeno označení jako odpověďLu Zou-MSFTMSFT, Moderátor13. února 2009 9:45
- Zrušeno navržení jako odpověďLu Zou-MSFTMSFT, Moderátor13. února 2009 9:45
- Navržen jako odpověďLu Zou-MSFTMSFT, Moderátor12. února 2009 9:13
- Označen jako odpověďLu Zou-MSFTMSFT, Moderátor13. února 2009 5:55
- Reagovat
- Citovat
13. února 2009 9:12Klemen30

0
Přihlásit se a hlasovat

Unfortunately, this is not the solution, 3351 events are back (20:30PM, 1:30AM, 2:00AM)

:(

tnx

klemen
- Reagovat
- Citovat
17. února 2009 11:04Lu Zou-MSFTMSFT, Moderátor

0
Přihlásit se a hlasovat
Hi

Could you check the account name of the application pool of the portal site again and do the steps in the article below to see if this can work?

http://technet.microsoft.com/en-us/library/cc561068.aspx

Lu Zou
- Reagovat
- Citovat
20. února 2009 11:47Klemen30

0
Přihlásit se a hlasovat
All web application accounts are OK. Event ID 3351 pops up at 20:30PM (backup with CA ARC Serve Sharepoint agent), at 1:20AM (backup with STSADM command) and 2:00AM (I can't figure it out what's going on at 2:00AM ?).
Both backups are done without any error.

tnx,
klemen
- Reagovat
- Citovat
25. února 2009 8:50Klemen30

0
Přihlásit se a hlasovat
Hi,

Every time I run backup (from central administration or STSADM or CA ARCServe) event 3351 pops up on web front end server and event 18456 on SQL server. All backups are done without errors.
I've tried to update accounts http://support.microsoft.com/default.aspx/kb/934838 , but no luck.

Is there any solution?

tnx
klemen
- Reagovat
- Citovat
2. března 2009 8:07Klemen30

0
Přihlásit se a hlasovat
Hi, Running Windows sharepoint services vss writer service under AD farm account (instead of Local system) is the solution of my issue! I'm so happy :) Tnx, Klemen
- Označen jako odpověďKlemen30 2. března 2009 8:07
- Reagovat
- Citovat