File System Auditor - Event ID 100 Unable to open the database (4263155)

The information in this article applies to:

File System Auditor Version 2.5x and higher

SYMPTOM:

The error “Event ID: 100 Unable to open the database.” Is found in the application event log, as shown below: 

Event Type: Error
Event Source: File System Auditor
Event Category: None
Event ID: 100
Date: 3/28/2008
Time: 1:51:38 PM
User: N/A
Computer: COMPUTERNAME

Description:
The description for Event ID ( 100 ) in Source ( File System Auditor ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Unable to open the database.
Login failed for user 'DOMAIN\USERNAME$'.
Error = -2147217843.

================================================================================

The description for Event ID ( 100 ) in Source ( File System Auditor ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Unable to open the database.
Login failed for user 'sa'.
Error = -2147217843.
================================================================================

The description for Event ID ( 100 ) in Source ( File System Auditor ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Unable to open the database.
Cannot open database requested in login 'SLFileAuditor'. Login fails.
Error = -2147467259.
================================================================================ 

CAUSE: 

The Event ID 100 error can be related to one (or more) of the following reasons:

• The database server is stopped.

• The database is not accessible because of insufficient access rights of the account used to run the FSA service, or the account logged onto the machine accessing the File System Auditor application.

RESOLUTION: 

To resolve this issue, verify the following:  

Step 1: Verify the database and SQL service is running:

• The File System Auditor database exists within SQL or SQL Express. By default the database is called ‘SLFileAuditor’ unless otherwise altered during database creation.

• The MSSQLSERVER service is running on the machine that hosts the File System Auditor database.

Step 2: The File System Auditor Agent is correctly configured

• Launch the Agent Configuration Console

• Click on the file server on the left side

• Click on Change Database settings under Database settings.

• This will bring up the database settings of the file server. SQL Server instance name should match the database where File System Auditor is residing and Database drop down list should display all the available databases including the File System Auditor database.

Step 3: Verify that TCP/IP and Named pipes are enabled and the SQL port is open:

• Logon to the SQL server

• Run SQL Server Configuration Manager

• Expand SQL Server Network Configuration

• Click on the instance where the database is residing

• Ensure Named Pipes and TCP/IP are enabled

• Double click on TCP/IP. Ensure the port (1433 default) is configured as shown below:

• On the machine where the agent is installed and on the File System Auditor machine go to Start > Run and enter “cliconfg”. The results should look as displayed below, having TCP/IP first in order. Highlight TCP/IP and select Properties to make sure you’re using the correct port. The default port for SQL is 1433. Also, check “Enable shared memory protocol”, then click “OK”:

• RDP to the server where the File System Auditor agent is installed and telnet to the SQL machine on port 1433.

• Telnet client is not installed on Windows 7 and 2008 servers by default. Install the telnet client if needed and then run following command via the command prompt.

          Telnet <SQL Server IP Address or Name> port number, example: Telnet DNA-VSQL01 1433

• If a blank screen is displayed and no error message prompted, the port is open and the server is communicating.

Step 4: During the database creation two security groups (Local, Global or Domain Local) are created; FSA_Admin and FSA_User. The service account used to install/run the File System Auditor Agent must be member of FSA_Admin group for Windows authentication in order to be able to write to the database.  

If all the steps above have been confirmed and working successfully, the Event Id 100 error message should be resolved. In order to perform a test, stop and restart the auditing.