Event 36887, Schannel, The following fatal alert was received: 46.

Foglight version 5.7.5.41

I am getting this error on all my monitored SQL Server instances. Event 36887, Schannel, The following fatal alert was received: 46.  Foglight is not showing any errors and it looks like it is monitoring but it is spamming the IT department with alerts.  It looks like a bad certificate but I can't identify which one. 

What I have been able to look up is the Guid associated with the error can be found in the registry under the following path

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{1f678132-5938-4686-9fdc-c8ff68f15c85}

ResourceFileName | REG_EXPAND_SZ | %windir%\System32\lsasrv.dll

- System

  - Provider

   [ Name]  Schannel
   [ Guid]  {1F678132-5938-4686-9FDC-C8FF68F15C85}
 
   EventID 36887
 
   Version 0
 
   Level 2
 
   Task 0
 
   Opcode 0
 
   Keywords 0x8000000000000000
 
  - TimeCreated

   [ SystemTime]  2018-03-12T18:15:51.791018300Z
 
   EventRecordID 6799563
 
   Correlation
 
  - Execution

   [ ProcessID]  500
   [ ThreadID]  7416
 
   Channel System
 
  - Security

   [ UserID]  S-1-5-18
 

- EventData

  AlertDesc 46

Parents
  • As this has been over two years later, I assume there was a fix for this after raising a ticket?  I plan to do the same, but would like to see if I can get either of your input on this issue in the interim as I have the exact same event log continually logging events on my Rapid Recovery (6.1.3) core.

Reply
  • As this has been over two years later, I assume there was a fix for this after raising a ticket?  I plan to do the same, but would like to see if I can get either of your input on this issue in the interim as I have the exact same event log continually logging events on my Rapid Recovery (6.1.3) core.

Children