SQL Server Login Failures (Error 18456) due to Reporting Services attempting to access non-existent ReportServer database

We are experiencing repeated SQL Server login failures (Event ID 18456) on one of our servers.

Details:

• SQL Server Version: SQL Server 2016
• Error Message: "Login failed for user 'REA\IND-WBN-DEV$'. Reason: Failed to open the explicitly specified database 'ReportServer$MSSQLSERVER2016'. [CLIENT: <local machine>]"

Observations:

• The database 'ReportServer$MSSQLSERVER2016' does not exist on the instance.
• The login 'REA\IND-WBN-DEV$' has default database set to 'master'.
• No SQL Agent jobs, stored procedures, or database objects reference the missing database.
• The issue is generating a high volume of log entries (thousands of events), impacting monitoring (SIEM/Wazuh alerts).

Further investigation shows that:

• The service "SQL Server Reporting Services (MSSQLSERVER2016)" is running on the server.
• It appears that Reporting Services is attempting to connect to a ReportServer database that is not present or not configured.

Questions:

1. Is it expected behavior for SSRS to continuously attempt connection and generate login failures when the ReportServer database is missing?
2. What is the recommended approach:
   • Disable the SSRS service if not in use, or
   • Reconfigure SSRS to remove or correct the database dependency?
3. Is there any recommended way to suppress or reduce excessive login failure logging in this scenario?

Impact:

• High volume of security logs (Event ID 18456)
• Noise in SIEM alerts
• Potential concern for false-positive brute force detection

We would appreciate guidance on best practices for handling this situation.