January 4, 2002 at 1:22 am
Hi there,
As part of our security processes we need to identify any failed logins to the database - we're using SQL Server 7 on WinNT 4 and are using SQL Server authentication. Is there a table or log-file I can query to see if a login failed (incorrect password, unknown user id etc)?
Thanks in advance,
Steve Hall
Polk (UK) Ltd
January 4, 2002 at 4:40 am
You can turn on auditing which will write it to the event log. If you'd rather have it in a table you could run a server side trace (though you have to log to a file and then import). If you use the trace just have to set up as a job that runs on startup.
Andy
January 8, 2002 at 12:32 pm
I have currently automated the whole process and it sends me an email at the end of every business day with a formated HTML table containing all the failed logins from that particular server. For starters look into FINDSTR a DOS utility that can parse a file and look for strings. Since the person attemping to login never gets in you only get the login account that attemped to login written to the sql error log. Only turn on failed attemps or your error log will grow very rapidly. Can enable from the gui or enable error logging for 18456. I found the gui works every time and enabling the 18456 on one of my machines never took.
pochinej
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply