• State Suggested Answer
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 60 subscribers
  • Views 21867 views
  • Users 0 members are here
Options
Related

Event 36887, Schannel, The following fatal alert was received: 46.

kfrazier
over 6 years ago

Foglight version 5.7.5.41

I am getting this error on all my monitored SQL Server instances. Event 36887, Schannel, The following fatal alert was received: 46.  Foglight is not showing any errors and it looks like it is monitoring but it is spamming the IT department with alerts.  It looks like a bad certificate but I can't identify which one. 

What I have been able to look up is the Guid associated with the error can be found in the registry under the following path

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1f678132-5938-4686-9fdc-c8ff68f15c85}

ResourceFileName | REG_EXPAND_SZ | %windir%\System32\lsasrv.dll

- System

  - Provider

   [ Name]  Schannel
   [ Guid]  {1F678132-5938-4686-9FDC-C8FF68F15C85}
 
   EventID 36887
 
   Version 0
 
   Level 2
 
   Task 0
 
   Opcode 0
 
   Keywords 0x8000000000000000
 
  - TimeCreated

   [ SystemTime]  2018-03-12T18:15:51.791018300Z
 
   EventRecordID 6799563
 
   Correlation
 
  - Execution

   [ ProcessID]  500
   [ ThreadID]  7416
 
   Channel System
 
  - Security

   [ UserID]  S-1-5-18
 

- EventData

  AlertDesc 46

  • 0 over 6 years ago
    Hello,

    I'm not sure if this can be solved via this forum, we might need a service request for it.
    But first check if this page could help you:
    blogs.msdn.microsoft.com/.../

    If not, we need to check the SQL Server agent logs and see if the agent triggers an error which provides more details.

    I searched for the alert + event ID and I found several webpages explaining the issue, but I'm not sure which one matches with your setup.

    Maybe one of my colleagues following this forum have see this issue before.
    If not, please raise a service request and provide the Foglight support bundles for further investigation. If you do not know how to create the support bundle, look at here:
    support.quest.com/.../41911

    Regards
    Nicola
  • 0 over 4 years ago

    As this has been over two years later, I assume there was a fix for this after raising a ticket?  I plan to do the same, but would like to see if I can get either of your input on this issue in the interim as I have the exact same event log continually logging events on my Rapid Recovery (6.1.3) core.

  • 0 over 4 years ago in reply to rclinard

    Hello rclinard,

    I do not know if there was a ticket raised after I replied to the original thread. Maybe one of my colleagues took it.

    If there was an issue, it should have been fixed in the meantime. I have done some search in our knowledge base and found a fixed bug referring to Event ID 36887. But I cannot say if it was based on the above described issue.

    Two years ago the customer used cartridge version 5.7.5.41 which is very old and not supported anymore. Currently, we are at version 5.9.4.20.

    If you will see the same or similar issue, please raise a ticket and we will investigate the root cause.

    Let me know if you have further questions.

    Kind Regards

    Nicola