Login Failed for user

Hi all,
I have these lines repeated many times, every 1 second, in the error log:
Login failed for user 'user'
Login failed for user 'sa'
Login failed for user 'root'
Login failed for user 'admin'
Is someone trying to hack my SQL server (version is 2000)?
How can I control and stop these logins?
Thank you
SajithAnswered in another newsgroup.|||Sure looks like it...can you see the source IP in the Security Event logs?
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"Sajith" <Sajith@.discussions.microsoft.com> wrote in message
news:122146B0-305E-4E0F-90F1-99B67A9FDE61@.microsoft.com...
> Hi all,
> I have these lines repeated many times, every 1 second, in the error log:
> Login failed for user 'user'
> Login failed for user 'sa'
> Login failed for user 'root'
> Login failed for user 'admin'
> Is someone trying to hack my SQL server (version is 2000)?
>
> How can I control and stop these logins?
> Thank you
> Sajith|||Is the server exposed to the WWW? If so, does it need to be? I would disable
the TCP/IP protocols and cut off the ports if you are not sharing the
server. Do you have SP2 (at least) installed? Consider that 80% of all
hacking comes from within the organization. Have you notified your security
department?
____________________________________
William (Bill) Vaughn
Author, Mentor, Consultant
Microsoft MVP
INETA Speaker
www.betav.com/blog/billva
www.betav.com
Please reply only to the newsgroup so that others can benefit.
This posting is provided "AS IS" with no warranties, and confers no rights.
__________________________________
Visit www.hitchhikerguides.net to get more information on my latest book:
Hitchhiker's Guide to Visual Studio and SQL Server (7th Edition)
and Hitchhiker's Guide to SQL Server 2005 Compact Edition (EBook)
----
---
"Sajith" <Sajith@.discussions.microsoft.com> wrote in message
news:122146B0-305E-4E0F-90F1-99B67A9FDE61@.microsoft.com...
> Hi all,
> I have these lines repeated many times, every 1 second, in the error log:
> Login failed for user 'user'
> Login failed for user 'sa'
> Login failed for user 'root'
> Login failed for user 'admin'
> Is someone trying to hack my SQL server (version is 2000)?
>
> How can I control and stop these logins?
> Thank you
> Sajith|||This server is exposed to www. but it is very secured. sql server 2000 is
with sp4 and in Windows 2003 with latest patch.
I have already notified the security dept. Today they are activating sniffer
s/w for this. Thanks for your valuable advise...
"William (Bill) Vaughn" wrote:

> Is the server exposed to the WWW? If so, does it need to be? I would disab
le
> the TCP/IP protocols and cut off the ports if you are not sharing the
> server. Do you have SP2 (at least) installed? Consider that 80% of all
> hacking comes from within the organization. Have you notified your securit
y
> department?
> --
> ____________________________________
> William (Bill) Vaughn
> Author, Mentor, Consultant
> Microsoft MVP
> INETA Speaker
> www.betav.com/blog/billva
> www.betav.com
> Please reply only to the newsgroup so that others can benefit.
> This posting is provided "AS IS" with no warranties, and confers no rights
.
> __________________________________
> Visit www.hitchhikerguides.net to get more information on my latest book:
> Hitchhiker's Guide to Visual Studio and SQL Server (7th Edition)
> and Hitchhiker's Guide to SQL Server 2005 Compact Edition (EBook)
> ----
---
> "Sajith" <Sajith@.discussions.microsoft.com> wrote in message
> news:122146B0-305E-4E0F-90F1-99B67A9FDE61@.microsoft.com...
>
>|||Hi kevin,
it is not listed under the even log. today we are activating the sniffer
s/w, I will tell you the status soon. thanks for your valuable advise...
"Kevin3NF" wrote:

> Sure looks like it...can you see the source IP in the Security Event logs?
> --
> Kevin Hill
> 3NF Consulting
> http://www.3nf-inc.com/NewsGroups.htm
> Real-world stuff I run across with SQL Server:
> http://kevin3nf.blogspot.com
>
> "Sajith" <Sajith@.discussions.microsoft.com> wrote in message
> news:122146B0-305E-4E0F-90F1-99B67A9FDE61@.microsoft.com...
>
>