Do you have a comment or suggestion to improve SQL Server? We’d love to hear it!

RING_BUFFER_SECURITY_ERROR - extended events

In the extended events, this error is happens constantly. I've searched the web with no luck in determining the cause of these RING_BUFFER_SECURITY_ERROR errors. It's in versions 2008 R2, 2012 and 2014. Any help in determining the cause of this would be appreciated.

other details" Error code: 0x139F NLShimImpersonate ImpersonateSecurityContext

you can use this query to list the errors out:

SELECT CONVERT (varchar(30), GETDATE(), 121) as runtime,
dateadd (ms, (a.[Record Time] - sys.ms_ticks), GETDATE()) as [Notification_Time],
a.* , sys.ms_ticks AS [Current Time]
FROM
(SELECT
x.value('(//Record/Error/ErrorCode)[1]', 'varchar(30)') AS [ErrorCode],
x.value('(//Record/Error/CallingAPIName)[1]', 'varchar(255)') AS [CallingAPIName],
x.value('(//Record/Error/APIName)[1]', 'varchar(255)') AS [APIName],
x.value('(//Record/Error/SPID)[1]', 'int') AS [SPID],
x.value('(//Record/@id)[1]', 'bigint') AS [Record Id],
x.value('(//Record/@type)[1]', 'varchar(30)') AS [Type],
x.value('(//Record/@time)[1]', 'bigint') AS [Record Time]
FROM (SELECT CAST (record as xml) FROM sys.dm_os_ring_buffers
WHERE ring_buffer_type
= 'RING_BUFFER_SECURITY_ERROR'
) AS
R(x)) a
CROSS JOIN sys.dm_os_sys_info sys
ORDER BY a.[Record Time] DESC

3 votes
Sign in
Check!
(thinking…)
Reset
or sign in with
  • facebook
  • google
    Password icon
    Signed in as (Sign out)

    We’ll send you updates on this idea

    AdminMicrosoft SQL Server (Admin, Microsoft Azure) shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

    Upvotes: 7

    <=-=Jun 20 2016 1:47AM=-=>

    I can see similar issue on SQL Server 2014 – (12.0.2000.8) and I would be more than happy to know what’s the reason of ring buffer flooding by this event.

    <=-=Sep 22 2017 2:47AM=-=>

    I’m seeing this on SQL Server 2016 SP1 CU4

    1 comment

    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      Signed in as (Sign out)
      Submitting...
      • János Berke commented  ·   ·  Flag as inappropriate

        I have the same issue with SQL Server 2016 as well. We see only when SQL login was used. It seems the event triggered in some unexpected cases as well. we are opening an SR due to the flooding and the overhead of the writing of 2K+events in the XE file.
        Here is a call stack of the login and the error:
        sqllang!intnl_impersonate_client
        sqllang!FInterrogateLogin
        sqllang!FindLogin
        sqllang!login
        sqllang!process_login_finish
        sqllang!process_login
        sqllang!process_commands_internal
        sqllang!process_messages
        sqllang!TDSSNIClient::AddSSLProviderHandler
        sqllang!SNIProcessAddProviderOnWorker
        sqldk!SOS_Task::Param::Execute
        sqldk!SOS_Scheduler::RunTask
        sqldk!SOS_Scheduler::ProcessTasks
        sqldk!SchedulerManager::WorkerEntryPoint
        sqldk!SystemThread::RunWorker
        sqldk!SystemThreadDispatcher::ProcessWorker

        a complete repro and xe processing script is available in case of request.

      Feedback and Knowledge Base