Hi All,

Is there a way for me to tell who is using
this EOL (end of life) java script?

C:\Program Files\Microsoft SQL
Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17.jar

Many thanks,
-T

T <T@invalid.invalid> wrote:

> Is there a way for me to tell who is using this EOL (end of life) java
> script?

Is there really a Java script inside that file? Might be just a logfile
using .jar for compressed storage.

> C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17.jar

How about using SysInternals' ProcMon? Define a filter that looks on
just that file, like a Path filter on just the filename or the complete
path to the file (if there are other files with the same name). A
filter doesn't make its log any smaller (still records everything, so
only run when needed since the recording can eventually slow the
computer), but lets you focus on which process is touching the file.

Doesn't the path you already mention indicate what program is using the
log file? Looks like the path is under Microsoft SQL Server. The log
entries might indicate what was requested of the SQL Server. I've not
use MS SQL, but apparently you can see who logged into it.

https://www.techonthenet.com/sql_server/questions/find_logins.php

There are SQL newsgroups (under microsoft.*), but I don't know if
they're much active anymore. There are MS SQL forums at:

https://learn.microsoft.com/en-us/answers/tags/191/sql-server
https://techcommunity.microsoft.com/t5/sql-server/ct-p/SQL-Server

I haven't been to https://answers.microsoft.com/ for a long time. Looks
like a mess of mashing a whole range of topics into one top-level forum.
A lot of inquiries there have moderators pointing back to the first link
I gave above.

T wrote:

> Is there a way for me to tell who is using
> this EOL (end of life) java script?

java isn't javascript

Java classes within a web page are EoL, javascript is still alive, java
for enterprise/back-end apps is alive too.

> C:\Program Files\Microsoft SQL
> Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17.jar

That looks dangerously old ...
<https://en.wikipedia.org/wiki/Log4Shell>

On 3/11/24 02:11, VanguardLH wrote:
> T <T@invalid.invalid> wrote:
>
>> Is there a way for me to tell who is using this EOL (end of life) java
>> script?
>
> Is there really a Java script inside that file? Might be just a logfile
> using .jar for compressed storage.
>
>> C:\Program Files\Microsoft SQL Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17.jar
>
> How about using SysInternals' ProcMon? Define a filter that looks on
> just that file, like a Path filter on just the filename or the complete
> path to the file (if there are other files with the same name). A
> filter doesn't make its log any smaller (still records everything, so
> only run when needed since the recording can eventually slow the
> computer), but lets you focus on which process is touching the file.
>
> Doesn't the path you already mention indicate what program is using the
> log file? Looks like the path is under Microsoft SQL Server. The log
> entries might indicate what was requested of the SQL Server. I've not
> use MS SQL, but apparently you can see who logged into it.
>
> https://www.techonthenet.com/sql_server/questions/find_logins.php
>
> There are SQL newsgroups (under microsoft.*), but I don't know if
> they're much active anymore. There are MS SQL forums at:
>
> https://learn.microsoft.com/en-us/answers/tags/191/sql-server
> https://techcommunity.microsoft.com/t5/sql-server/ct-p/SQL-Server
>
> I haven't been to https://answers.microsoft.com/ for a long time. Looks
> like a mess of mashing a whole range of topics into one top-level forum.
> A lot of inquiries there have moderators pointing back to the first link
> I gave above.

I will remote in tomorrow. I also notice tht whoever has
this file on the machine also had Java installed as well.
I am thinking it is a hold over from something no
longer used, but ...

I an not tell who is using M$SQL. That would solve
the puzzle. ProcMon to the rescue?

On 3/11/24 02:24, Andy Burns wrote:
> T wrote:
>
>> Is there a way for me to tell who is using
>> this EOL (end of life) java script?
>
> java isn't javascript

I always goof that one. Thanks for the heads up.
>
> Java classes within a web page are EoL, javascript is still alive, java
> for enterprise/back-end apps is alive too.
>
>> C:\Program Files\Microsoft SQL
>> Server\150\DTS\Extensions\Common\Jars\log4j-1.2.17.jar
>
> That looks dangerously old ...
> <https://en.wikipedia.org/wiki/Log4Shell>

Wow! I wrote both the software vendors on these machines
asking them if it was them.

Thank you!

T wrote:
> I [c]an not tell who is using M$SQL.  That would solve
> the puzzle.  ProcMon to the rescue?
As a starting point, I'd try
netstat -an | find ":1433"

On 3/11/24 03:42, Andy Burns wrote:
> T wrote:
>
>> I [c]an not tell who is using M$SQL.  That would solve
>> the puzzle.  ProcMon to the rescue?
>
> As a starting point, I'd try
> netstat -an | find ":1433"
>
>

I figured out who was using it. But 1433 did not show up on netstat

netstat -an | find ":1433"
<nothing>

netstat -an | grep ":1433"
<nothing>

1434 does show up, but does ot tell me who:
netstat -an | grep ":1434"
UDP 0.0.0.0:1434 *:*
UDP [::]:1434 *:*

netstat -ab
....
UDP 0.0.0.0:1434 *:*
[sqlbrowser.exe]
....
UDP [::]:1434 *:*
[sqlbrowser.exe]

which is in
C:\Program Files (x86)\Microsoft SQL Server\90\Shared

Hmmmmmmm. Anyway I know what program it is that is using it.
-T

T wrote:
> I figured out who was using it.  But 1433 did not show up on netstat
1433 is the default port fr actual SQL connections, IME it'd be unusual
to change the port from default, since its usually purely internal.
> 1434 does show up
that's just the SQL browser, used by Management Studio to locate SQL
running instances
but does ot tell me who:
> netstat -an | grep ":1434"
>   UDP    0.0.0.0:1434           *:*
>   UDP    [::]:1434              *:*
yes, it's listening but no connections
> netstat -ab
> ...
>  UDP    0.0.0.0:1434           *:*
>  [sqlbrowser.exe]
> ...
>  UDP    [::]:1434              *:*
>  [sqlbrowser.exe]
>
> which is in
>     C:\Program Files (x86)\Microsoft SQL Server\90\Shared
>
>
> Hmmmmmmm.  Anyway I know what program it is that is using it.
Stop the SQL servive for a few minutes/hours/weeks, see if anyone complains!

On 3/12/24 02:00, Andy Burns wrote:
> Stop the SQL servive for a few minutes/hours/weeks, see if anyone
> complains!

Oh I know exactly who is going to complain! The customer
reminded me that the software in question first installs
M$SQL Server.