Reporting on Failed Login attempts (for S-Ox)

[UpstateNYAdmin]

For SQL 2000 (SP4) on Win2K3 I need to start reporting on failed login attempts for several servers in the organization. I have set the audit level to capture the failed attempts. Since that only appears to write to the Application event log and SQL logs, is there any other place that those attempts are stored, like a system table? I would like to get a little more info then either log seems to store. Has anyone come across an easy way get that type of info, whether its some sort of trigger or something.

Thanks
Pat

 

[ptheriault]

You could set up profiler to write to a file or table and log failed logins.

- Paul

- If at first you don't succeed, find out if the loser gets anything.

 

[mrdenny]

By default the only places those events are written are the ERRORLOG and Application Log.

If you need to capture more information I would recommend setting up a SQL Trace to run in the backgroud (via a job) every time the SQL Server starts up which logs it's data into a table.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com