Login Failure Auditing + Profile trace

  • Hi,

    I have recently been looking at Login failures on my production SQL Server. Previously, no monitoring was being performed on this box, so I have a fair few failures to try and explain.

    All login failures are getting placed in the SQL Logs, and I have an alert set up to email me when one occurs. I am seeing about 15 failures from a particular server everyday at 0630.

    The problem is that the SQL Logs don't provide enough information for me to troubleshoot the issue, they only provide the very basics, login name and IP address. I have used SQL Server Profiler to check login failures before, and this can give excellent information, such as ApplicationName and process ID which really helps me narrow down the issue.

    So, my question is, can I get the SQL logs to include all of the information that SQL Profiler is able to grab, appname, procid etc.? If this can't be done, how can I schedule the Profiler to run just before 0630?

    Thanks,

    Bodsda

  • All Profiler does is run a trace. Create a server-side trace, and you can have it run constantly or you can use an SQL Agent job to schedule it for a specific time span.

    - Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
    Property of The Thread

    "Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon

Viewing 2 posts - 1 through 1 (of 1 total)

You must be logged in to reply to this topic. Login to reply