none
SQL 2012 - Extended Events->System_health->Watch Live Data Output - Security_error_ring_buffer_recorded Events Query

    Question

  • Hi all,

    Just wondering how I should interpret these log messages when I watch live data if there are no failed Login attempts logged in the SQL Server Logs?

    Any advice appreciated.

    Kind Regards,

    Matt
    Friday, November 08, 2013 6:14 AM

All replies

  • There are a lot of these entries which are happening and i am concerned if there is a problem or not given that the SQL Server Log's don't show any errors.
    Friday, November 08, 2013 6:15 AM
  • So what exactly are you seeing?


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se
    Friday, November 08, 2013 10:44 PM
  • Hi Erland,

    The log i am seeing is
    "security_error_ring_buffer_recorded".

    pretty much i have drilled into
    the system_health section of management studio in sql 2012
    and chose to
    "watch Live Data" and i see these are ticking all the time.

    When I click
    on one of the Displayed events it shows

    api_name
    ImpersonateSecurityContext
    call_stack0x6ED03CDBFC0700002CAC2CDBFC070000F5012DDBFC070000086B2CDBFC070000CD5F2CDBFC070000E4D03CDBFC070000E03722DAFC070000843C22DAFC070000673922DAFC0700003FD624DAFC070000B0E024DAFC070000BBF024DAFC07000098D824DAFC0700007E16C7E6FC070000F1C34CE7FC070000
    calling_api_name
    NLShimImpersonate
    error_code 5023
    id 0
    session_id 3290
    timestamp
    534549
    Monday, November 11, 2013 12:12 AM
  • Looks like a similar issue is blogged about here.  Note error code 5023 translates to 139F in hex, the same error as in the blog post.

    Monday, November 11, 2013 1:17 AM
  • Ok i will take a look into that article.

    I have traced the errors back to two SQL Logins which are used for our main .net Internal Application Client. THe strange thing is that none of the users which use the Application CLient are experiencing any issues.

    Anyways i will continue to look into this and see what I can find - thanks

    Monday, November 11, 2013 1:47 AM
  • Also none of the Security_error_ring_buffer_recorded Events corrolate to anything in the SQL Error Log.

    Monday, November 11, 2013 1:52 AM
  • Ask your .net developers to tell you what the SQL logins are used for.  Is it a key part of the application, or just something that polls but never gets used, hence the users not experiencing issues.

    Also, double-check your SQL Server is in mixed mode, as this is turned off by default from SQL 2005 onwards I think and a SQL Server restart is required to change the setting.

    Monday, November 11, 2013 3:02 AM
  • The logins are not used for anything specific .net code wise but moresor are general use login for day to day application use when connecting to the database.

    The sql server is already in mixed mode. Please note that if was not in Mixed mode then there would be SQL Server Error logs indicating that there is a logon error and there isn't.

    Like I said, there are no SQL Server Error Log entries for Login type errors which corrolate to the Security_error_ring_buffer_recorded Events.

    Monday, November 11, 2013 3:22 AM
  • Having said that I appreciate your suggestion.
    Monday, November 11, 2013 3:24 AM
  • Also none of the Security_error_ring_buffer_recorded Events corrolate to anything in the SQL Error Log.

    Hi killerchef,

    The ring buffers are used in situations when losing events is not fatal, and other forms of queue management have bigger problems. This extended events means reading the ring buffer, and recording the information to a log file.

    It isn't an error. It is detailed logging telling you what it is doing with the security errors (e.g. failed logins) to make sure they don't get lost. So as you post, none of the Security_error_ring_buffer_recorded Events correlate to anything in the SQL Error Log.

    For information about this ring buffers events, you can review the following article.
    http://www.faultserver.com/q/answers-security-error-ring-buffer-recorded-in-system-health-log-what-does-it-mean-496407.html

    Thanks,
    Sofiya Li



    Your Name
    TechNet Community Support

    Tuesday, November 12, 2013 3:06 AM
  • Thanks for your explanation however I still have some questions

    Is it something to be concerned about?

    How can I trace to find the source as to this why this detailed Log is being generated?

    The fact that these "detailed logs" are getting recorded constantly on the production sql server is of a concern to me given that on our other production sql servers they are not occuring.

    Should I be concerned in your opinon?

    I will continue to do some research on the "detailed log".

    Any thoughts appreciated.

    Friday, November 15, 2013 8:25 AM