March 13, 2006 at 7:35 am
Hi
I need to audit login failure on sql2k. The information I need to retieve is the user or app that is trying to login. Anyone any ideas on the best was to do this?
Thanks
BJ
March 13, 2006 at 7:44 am
Using profiler with some of the security event classes should give you enough info.
March 14, 2006 at 1:10 pm
In EM right click on the SQL Server, select properties and go to the Security tab. Once there check the radio button for Failure under Audit Level. Then you need to restart your SL Server. This will allow all failed login attepmts to be loged to the SQL Server errorlog. However you will only get a date/time stamp and the login name supplied. As for getting application information I do not believe that that is possible on a failed login attempt from profiler (I may be mistaken). To my knowledge this type of information:
-- hostname nchar(128) Name of the workstation
-- program_name nchar(128) Name of the application program
-- hostprocess nchar(8) Workstation process ID number
Is only available from the master..sysprocesses table, and only if the connecting application supplies it within the connection string.
RegardsRudy KomacsarSenior Database Administrator"Ave Caesar! - Morituri te salutamus."
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply