Networker 7.5.4 Standard Client Logging in to SQL Server?

I don't know how familiar you are with SQL Server, but what I saw is definitely a log in.  I queried the SQL Server sessions views, which is where I received the log in alert.  Unfortunately, I did not get back any query text (it is about 50/50 on whether I get the query back or not).  I see that there were 8 logical reads on the session, which means that it definitely ran some query.  This is the query I ran to get the information:

SELECT DES.session_id, DES.login_time, RTRIM(DES.host_name), RTRIM(DES.program_name),

  DES.host_process_id, DES.client_version, RTRIM(DES.client_interface_name),

  DES.security_id, RTRIM(DES.login_name), RTRIM(DES.nt_domain),

  RTRIM(DES.nt_user_name), RTRIM(DES.status), DES.context_info, DES.cpu_time,

  DES.memory_usage, DES.total_scheduled_time, DES.last_request_start_time,

  DES.last_request_end_time, DES.reads, DES.writes, DES.logical_reads,

  DES.is_user_process, DES.text_size, RTRIM(DES.language), RTRIM(DES.date_format),

  DES.date_first, DES.quoted_identifier, DES.arithabort, DES.ansi_null_dflt_on,

  DES.ansi_defaults, DES.ansi_warnings, DES.ansi_padding, DES.ansi_nulls,

  DES.concat_null_yields_null, DES.transaction_isolation_level, DES.lock_timeout,

  DES.deadlock_priority, DES.row_count, DES.prev_error, DES.original_security_id,

  RTRIM(DES.original_login_name), DES.last_successful_logon,

  DES.last_unsuccessful_logon, DES.unsuccessful_logons,

  DEC.most_recent_session_id, DEC.connect_time, RTRIM(DEC.net_transport),

  RTRIM(DEC.protocol_type), RTRIM(DEC.encrypt_option), RTRIM(DEC.auth_scheme),

  DEC.num_reads, DEC.num_writes, DEC.last_read, DEC.last_write, DEC.net_packet_size,

  RTRIM(DEC.client_net_address), DEC.client_tcp_port, RTRIM(DEC.local_net_address),

  DEC.local_tcp_port, DEC.connection_id, DEC.parent_connection_id,

  DEC.most_recent_sql_handle,

  ISNULL(DB_NAME(SQ.dbid),'') [database_name],

  SQ.text,

  GETDATE() [capture_dt]

FROM sys.dm_exec_sessions DES

  LEFT OUTER JOIN sys.dm_exec_connections DEC ON

  DES.session_id = DEC.session_id

  LEFT OUTER JOIN sys.dm_exec_requests DER ON

  DES.session_id = DER.session_id

  LEFT OUTER JOIN (

  SELECT DEC2.session_id, DEST.text, DEST.dbid

  FROM sys.dm_exec_connections DEC2

  CROSS APPLY sys.dm_exec_sql_text(DEC2.most_recent_sql_handle) DEST

  ) SQ ON

  DES.session_id = SQ.session_id

WHERE DES.is_user_process = 1

I don't believe it is logging at all; I believe what you see is logging which comes out due to SQL VSS Writer and the way how event log mechanism is picking up events.

There actually is no VSS backup on this server.  It has a list of save sets; C:\, D:\, E:\, F:\, and SERVERNAME:index.  I guess it might use VSS to backup these drives, but it is not a save set of "ALL", so there are no VSS:BACKUPSET save sets backed up.

Actually it may requester for the query, and query itself is run by VSS as hinted before.  Tell me, does timestamp matches file system backup? NT AUTHORITY/SYSTEM indicates this is coming in your case from service which runs as such and belongs to NetWorker.  If you check timestamps, most likely you can tie that to VSS (and backup admin can also do a test without VSS).

It uses VSS for backup of drives (VSS is used not only for VSS save sets).