question

SalamElias-0832 avatar image
0 Votes"
SalamElias-0832 asked SalamELIAS-8667 published

Strange Login and AppDomain xx created

On a sql 2k16, when I go through error logs, I find a lot of messages las follows

Server Date Process Count Text
SQL2K12 2021-03-15 13:30:44.640 spid17s 1 AppDomain 39 (MDS.mds_schema_user[runtime].38) unloaded.
SQL2K12 2021-03-15 13:00:15.550 spid62 1 AppDomain 40 (master.sys[runtime].39) created.
SQL2K12 2021-03-15 13:00:15.550 spid62 1 AppDomain 40 (master.sys[runtime].39) created.
SQL2K12 2021-03-15 10:00:43.090 spid45s 1 AppDomain 39 (MDS.mds_schema_user[runtime].38) created.


Not sure what this appDomain creating and unloading?
Thanks

sql-server-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SalamElias-0832 avatar image
0 Votes"
SalamElias-0832 answered ErlandSommarskog commented

I monitor both error logs for default and named instance with the same powershell script and it populates a table, 1st column in this table is SQLInstance anme
84351-sqlinst.jpg


The email/alert I receive from my script that runs every 1 hour indicates an error in the default instance as noted above, again here it is
84352-sqlinstdef.jpg



sqlinstdef.jpg (31.1 KiB)
sqlinst.jpg (29.8 KiB)
sqlinstdef.jpg (31.1 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

OK, so if this error is logged on the default instance, I would guess comes from a job on the named instance. It could also be something that connects to the named instance and then tries to access the default instance over a linked server or similar, but look at the jobs on the named instances first.

0 Votes 0 ·
SalamElias-0832 avatar image
0 Votes"
SalamElias-0832 answered ErlandSommarskog commented

I have 5 or 6 jobs in the named instance, while I was checking, I noticed that the SQL Agent in the named instance runs under a user

NT SERVICE\SQLAgent$SC2K12

After reading the thread
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/9e6bb2de-8fd0-45de-ab02-d59bbe05f72e/servicedatabase-accounts-nt-servicemssqlserver-amp-nt-servicesqlserveragent-8230-what-are#:~:text=The%20SQL%20Server%20Agent%20runs%20as%20a%20Windows,what%20it%20should%20do%3B%20and%20then%20do%20it.
I understood that I should have a group where those users are listed which is not the case when I run

lusrmgr.msc

84389-lusmgr.jpg





lusmgr.jpg (76.7 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

That article refers to SQL 2008. As Rick points out, things changed in SQL 2012 ("Denali"). WhenI look at my machine, I see such groups for my SQL 2005 and SQL 200( instances, but not for my later instances.

0 Votes 0 ·
SalamELIAS-8667 avatar image
0 Votes"
SalamELIAS-8667 answered SalamELIAS-8667 published

OK, but in any case, I went trhough all jobs (8 or 9) on the named instance, 4 of them are installed by sql whic were has added during setup, the rest are 5 jobs created by maintenance script from https://ola.hallengren.com, so really where does this
salam\sql2k12$ on ip ::1.
I just double checked my users in the domain, no such user, double-checked login in sql server, it cant find any such thing

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.