April 25, 2006 at 5:58 pm
There must be an easy way to monitor failed loging attempts... especially SA ones! but i cant find a method. Can this sort of information written to a log somewhere? I'd prefer to see this information outside of the database if possible.
So how can one know if someone attempted to login as SA and failed?
How can i find out who has been trying to drive my sweet ride?
SQL 2012 Standard VPS Windows 2012 Server Standard
April 26, 2006 at 10:59 pm
If you have audit failure logging turned on for your SQL Server (remember that once you make the configuration change you must stop and restart SQL Server for it to take effect), you'll see the audit failures show up in two places. One is the SQL Server error log. The other is the application event log for the OS. The login which failed will be contained in the text of the event record, so some parsing will be required.
K. Brian Kelley
@kbriankelley
April 27, 2006 at 6:00 am
As Brian suggested, turn on the auditing of failed logins. We then created an alert to email us any any failed logins. We used the following to email us of any failed SQL logins:
USE
[msdb]
GO
/****** Object: Alert [FailedSqlLoginNotification] Script Date: 04/27/2006 07:53:08 ******/
EXEC
msdb.dbo.sp_add_alert @name=N'FailedSqlLoginNotification',
@message_id
=18456,
@severity
=0,
@enabled
=1,
@delay_between_responses
=60,
@include_event_description_in
=5,
@category_name
=N'[Uncategorized]',
@job_id
=N'00000000-0000-0000-0000-000000000000'
GO
EXEC
msdb.dbo.sp_add_notification @alert_name=N'FailedSqlLoginNotification', @operator_name=N'DBA', @notification_method =1
We also have one for failed Windows NT logins. You potentially could get a lot of emails. I am sure that you could filter it if you wanted to only see certain failed logins. We have everything come to us.
HTH,
John
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply