B
Bones
Hey folks! This is not a critical issue but it is driving me crazy and I
haven't been able to find an answer to this on the net. Hopefully one of you
exceedingly bright people will shed some light on the errors I'm getting.
The setup is this: I use Arcserve to back up our various servers (all fully
up-to-date Windows 2003 SP2), mostly using shares on those servers as the
targets. Haven't had any problems with this procedure until I created our
standard backup area on a new server that's running SQL 2005, which dumps its
backups into this area. I've double and triple checked all permissions and
they are identical to all the other backup areas on our network. When my
backup job tries to backup the 19 files that are there, it first logs this
successful login on the Target_Server:
--------------------------------------------------------
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 576
Date: 3/5/2009
Time: 3:15:11 AM
User: Domain_Name\backup_username
Computer: Target_Server
Description:
Special privileges assigned to new logon:
User Name: backup_username
Domain: Domain_Name
Logon ID: (0x0,0x2A136E89)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 3/5/2009
Time: 3:15:11 AM
User: Domain_Name\backup_username
Computer: Target_Server
Description:
Successful Network Logon:
User Name: backup_username
Domain: Domain_Name
Logon ID: (0x0,0x2A136E89)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {ade88610-e2c0-7b1e-4d39-04020de3659c}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 10.150.2.12
Source Port: 0
--------------------------------------------------------
But then it logs exactly 37 of these errors in extremely rapid succession:
--------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 3/5/2009
Time: 3:15:11 AM
User: NT AUTHORITY\SYSTEM
Computer: Target_Server
Description:
Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC000006D
Substatus code: 0xC0000408
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
--------------------------------------------------------
At the same time, on the Backup _Server I get 37 of these errors:
--------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 673
Date: 2009-03-05
Time: 03:15:11
User: NT AUTHORITY\SYSTEM
Computer: Backup_Server
Description:
Service Ticket Request:
User Name: backup_username@Domain_Name.com
User Domain: Domain_Name.com
Service Name: Target_Server
Service ID: -
Ticket Options: 0x40810000
Ticket Encryption Type: -
Client Address: 127.0.0.1
Failure Code: 0x1B
Logon GUID: -
Transited Services: -
--------------------------------------------------------
Since some of these are Kerberos errors on the target server, I checked the
time and it's synched almost perfectly across the domain (all servers
literally within tenths/hundredths of a second of each other). As it happens,
these two servers are on the same gigabit switch to boot.
I have my suspicions about the number of errors (which is exactly 2 times
the number of files minus 1), but I don't know if it means anything.
Also, I recreated this backup area on another new server (not running SQL
though) and it backs up from that server with no errors whatsoever. I have
also been doing a similar backup on another SQL 2005 server for years and
never had a problem.
The reason this is not critical is that the files get backed up anyway! I've
restored them and done file comparisons and checked the data and they're
perfect.
It's just that unexplained errors are the bane of my existence and I gots ta
know (with apologies to the movie Dirty Harry).
TIA for any help.
Bones
haven't been able to find an answer to this on the net. Hopefully one of you
exceedingly bright people will shed some light on the errors I'm getting.
The setup is this: I use Arcserve to back up our various servers (all fully
up-to-date Windows 2003 SP2), mostly using shares on those servers as the
targets. Haven't had any problems with this procedure until I created our
standard backup area on a new server that's running SQL 2005, which dumps its
backups into this area. I've double and triple checked all permissions and
they are identical to all the other backup areas on our network. When my
backup job tries to backup the 19 files that are there, it first logs this
successful login on the Target_Server:
--------------------------------------------------------
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 576
Date: 3/5/2009
Time: 3:15:11 AM
User: Domain_Name\backup_username
Computer: Target_Server
Description:
Special privileges assigned to new logon:
User Name: backup_username
Domain: Domain_Name
Logon ID: (0x0,0x2A136E89)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 3/5/2009
Time: 3:15:11 AM
User: Domain_Name\backup_username
Computer: Target_Server
Description:
Successful Network Logon:
User Name: backup_username
Domain: Domain_Name
Logon ID: (0x0,0x2A136E89)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {ade88610-e2c0-7b1e-4d39-04020de3659c}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 10.150.2.12
Source Port: 0
--------------------------------------------------------
But then it logs exactly 37 of these errors in extremely rapid succession:
--------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 3/5/2009
Time: 3:15:11 AM
User: NT AUTHORITY\SYSTEM
Computer: Target_Server
Description:
Logon Failure:
Reason: An error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Status code: 0xC000006D
Substatus code: 0xC0000408
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
--------------------------------------------------------
At the same time, on the Backup _Server I get 37 of these errors:
--------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 673
Date: 2009-03-05
Time: 03:15:11
User: NT AUTHORITY\SYSTEM
Computer: Backup_Server
Description:
Service Ticket Request:
User Name: backup_username@Domain_Name.com
User Domain: Domain_Name.com
Service Name: Target_Server
Service ID: -
Ticket Options: 0x40810000
Ticket Encryption Type: -
Client Address: 127.0.0.1
Failure Code: 0x1B
Logon GUID: -
Transited Services: -
--------------------------------------------------------
Since some of these are Kerberos errors on the target server, I checked the
time and it's synched almost perfectly across the domain (all servers
literally within tenths/hundredths of a second of each other). As it happens,
these two servers are on the same gigabit switch to boot.
I have my suspicions about the number of errors (which is exactly 2 times
the number of files minus 1), but I don't know if it means anything.
Also, I recreated this backup area on another new server (not running SQL
though) and it backs up from that server with no errors whatsoever. I have
also been doing a similar backup on another SQL 2005 server for years and
never had a problem.
The reason this is not critical is that the files get backed up anyway! I've
restored them and done file comparisons and checked the data and they're
perfect.
It's just that unexplained errors are the bane of my existence and I gots ta
know (with apologies to the movie Dirty Harry).
TIA for any help.
Bones
