1

I'm new to SCOM 2007. Im trying to setup alerts and views for failed SQL login attempts. I've been on the internet for hours without any luck.

My test case is trying to connect to SQL server on the same machine with invalid login details.

Can someone please give me step by step instructions to accomplish this?

Thanks

1
  • are you still looking for an answer to this? Mar 10, 2010 at 5:24

1 Answer 1

1

I'm not familiar with SCOM, but these failures will show up in your application event log as this:

Event Type: Failure Audit
Event Source:   MSSQLSERVER
Event Category: (4)
Event ID:   18456
Date:       11/5/2009
Time:       9:33:49 AM
User:       N/A
Computer:   DEVMSSQL
Description:
Login failed for user 'bad_login'. [CLIENT: 0.0.0.0]

I would assume SCOM has facilities for alerting on event log entries of a certain ID.

Here is a blog on the subject: http://systemcenterinfo.blogspot.com/2008/05/opsmgr-monitoring-event-log-part-1.html

3
  • Thanks Sam, I'm trying that now. Another question...... Should the event be visible in SCOM immediately or will there be a delay of 12-15 mins?
    – Jacques
    Nov 5, 2009 at 17:27
  • I'm having trouble finding any documentation on the Microsoft site. Hopefully you have it with the install media, but there may be a setting on polling interval.
    – Sam
    Nov 5, 2009 at 19:51
  • But I would test by setting up the monitoring and then logging in through SSMS with an invalid login and invalid password.
    – Sam
    Nov 5, 2009 at 19:52

You must log in to answer this question.