Post reply

Not seeing failed logins in log viewer or profiler

  • October 15, 2019 at 2:45 pm

    #3688910

    I am auditing our SQL logins for usage. I have already disabled the ones that I am 99% sure are NOT being used. After disabling the logins I thought it would be a good idea to watch profiler or the SQL log viewer for any failed logins. I used SSMS to test a failed login with a disabled account, but I dont see the failure in profiler or log viewer. I tried with both a good password and a bad password for the SQL user, and neither showed up. Under server properties/login auditing the bubble for "failed logins only" is selected. What am I doing wrong?

  • October 15, 2019 at 2:56 pm

    #3688913

    figured it out in the sql log viewer. still not sure about sql profiler.

  • October 15, 2019 at 5:27 pm

    #3688980

    OK, I assume you mean that you can look at the SQL Server error log and see this. It is also logged to the Windows Application log, and you can find it there.

    For Profiler, this is reading trace events. By default, if you open the standard trace template in Profiler, this does not audit failed logins. Choose the show all events, and then find the audit failed event. You can see it below. The checked "audit login" is shown above this.

    2019-10-15 11_27_07-Trace Properties

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply