SQL Server Alert System – ‘Alert Severity 20’ Error

alertssql server

We occasionally get following email alerts.

DESCRIPTION: The login packet used to open the connection is structurally invalid; the connection has been closed. Please contact the vendor of the client library.

DESCRIPTION: Length specified in network packet payload did not match number of bytes read; the connection has been closed. Please contact the vendor of the client library.

I tried to search online. But I haven’t got any good direction about how exactly I should proceed to troubleshoot these alerts. Should I contact application team to check buggy code or security team to check any malicious activity in this case? Appreciate your guidance.

Best Answer

Check the SQL Server error log and you will find a corresponding log message that includes the IP address of the originating system. This will be the most important clue to investigating what is causing this.

It is most likely that this is being caused by security software that is scanning/probing your server for vulnerabilities. If you find that is not the case, then it is either something that is accidentally or maliciously attempting to make a connection to whatever port SQL Server is listening on.