Please be aware that the content in SAP SQL Anywhere Forum will be migrated to the SAP Community in June and this forum will be retired.

The database (SQL Anywhere 17) is "attacked" by an unknown application.
We receive dozens of messages:
I. 11/17 13:07:20. Connection from XX.X.XX.XXX:XXXXX assigned connection ID 224
E. 11/17 13:07:20. Connection ID 224: Connection error '28000': Invalid user ID or password

It does not reach the login_procedure, the message appears at the user/password verification stage.

Whether there is an opportunity means of a DB to learn what user and what application tries to connect to a DB?

ps I don't want to specify the number of failed login attempts, as it is suspected that a "good" user is using a "bad" password hidden in the application.

asked 17 Nov '22, 09:40

Ilia63's gravatar image

accept rate: 44%

You can get the userid by enabling auditing. See

But I wouldn't log to the transaction log for the output as the tutorial suggests. Use an event file instead:

Unfortunately, auditing doesn't log the "appinfo" string which contains the client app executable name, etc. I'm not sure if it is available to the server that early in the connection attempt but, if it is, I think we should enhance auditing to record it.

permanent link

answered 17 Nov '22, 09:57

John%20Smirnios's gravatar image

John Smirnios
accept rate: 37%

(17 Nov '22, 10:00) John Smirnios

Thanks! Great opportunity!

(17 Nov '22, 10:31) Ilia63
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 17 Nov '22, 09:40

question was seen: 427 times

last updated: 17 Nov '22, 10:31