Site down: error log pattern of login failure x20, then invalid object name x20, then again login failure x20

问题

Our Orchard CMS with multi-tenancy just went down. We have since brought it back online by restoring a version of the database, and then recycling the application pool. Communicating with the restored database continued to fail until we recycled the app pool.

The post-mortem analysis of the error log from yesterday had zero errors, and the error log from today has about forty errors with the following pattern:

1. About 20 SqlException errors reporting "invalid login" for two of the tenant databases.
2. Then about 20 SqlException errors reporting "invalid object name".
3. Then another 20 SqlException errors reporting "invalid login" for two of the tenant database.

The invalid objects were Scheduling_ScheduleTaskRecord, Awaiting_ActivityRecord, and Orchard_AliasRecord. After restoring the database and recycling the application pool, all the tenants are again up and running.

We hadn't done anything particularly unusual (e.g. didn't change passwords / firewall rules) to precipitate the errors.

It's as if something hacked the website, disrupted login, and then started to delete tables (or something like that). It occurs to be that Workflows might be involved, because the invalid objects appear related to Workflows, but we don't have any Workflows explicitly setup on our site.

I have no other questions than, "Why did this happen?"

Edit 1 Here is a link to the full logs: https://docs.google.com/file/d/0B4X0N4NlUl4mOHhWV2JwN1c0Uzg/edit?pli=1

Edit 2 Can you elaborate on "started to delete tables?" Yes. After a series of SqlExceptions, in which we could not open the database because the login failed, we started to receive a new SqlException which reported invalid object names. To me, invalid object name errors mean that Orchard thought tables should have existed that didn't exist. For example:

Could not execute query: 
    select aliasrecor0_.Id as Id379_, 
    aliasrecor0_.Path as Path379_, 
    aliasrecor0_.RouteValues as RouteVal3_379_, 
    aliasrecor0_.Source as Source379_, 
    aliasrecor0_.Action_id as Action5_379_ 
    from Orchard_Alias_AliasRecord aliasrecor0_ 
    where aliasrecor0_.Id>@p0 
    order by aliasrecor0_.Id asc
System.Data.SqlClient.SqlException (0x80131904): 
Invalid object name 'Orchard_Alias_AliasRecord'.

To me the Orchard_Alias_AliasRecord table is fundamental and it missing is an odd thing. Why would the SqlException first say that we could access the database, and then say that a fundamental table is invalid? My best guess is that something dropped some tables. What else could it be?

Edit 3 Did you actually lose data? I am not sure. I am a consultant to the company and haven't looked at the state of the database after the site went down. I helped to bring the site back on line and then tapped out because I felt over my head.

Edit 4 Why do you think workflow may be involved? I thought that workflows might be involved because two of the invalid objects were Scheduling_ScheduleTaskRecord and Awaiting_ActivityRecord. While I am not familiar with workflows, these seem to be related to automated tasks, and I think Workflows are involved in automated, schedule tasks. It was a long shot guess.

Edit 5 What are the "invalid objects"? How are they invalid?

• Scheduling_ScheduleTaskRecord,
• Awaiting_ActivityRecord, and
• Orchard_AliasRecord

I am not sure how they are invalid. Usually that means they don't exist or is in a different db schema. Since we're using multi-tenancy, it could be that Orchard should be looking for a prefixed table instead. I don't see any other hints from the log files. All they tell me is that it's an SqlException (0x80131904): Invalid object name. It's odd that after we restored the database to an earlier version, the errors stopped, which indicates that either Orchard stopped querying those tables or the tables somehow became valid again.

来源：https://stackoverflow.com/questions/25538086/site-down-error-log-pattern-of-login-failure-x20-then-invalid-object-name-x20