Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm new to SCOM 2007. Im trying to setup alerts and views for failed SQL login attempts. I've been on the internet for hours without any luck.

My test case is trying to connect to SQL server on the same machine with invalid login details.

Can someone please give me step by step instructions to accomplish this?

Thanks

share|improve this question
    
are you still looking for an answer to this? –  SQLRockstar Mar 10 '10 at 5:24

1 Answer 1

I'm not familiar with SCOM, but these failures will show up in your application event log as this:

Event Type: Failure Audit
Event Source:   MSSQLSERVER
Event Category: (4)
Event ID:   18456
Date:   	11/5/2009
Time:   	9:33:49 AM
User:   	N/A
Computer:   DEVMSSQL
Description:
Login failed for user 'bad_login'. [CLIENT: 0.0.0.0]

I would assume SCOM has facilities for alerting on event log entries of a certain ID.

Here is a blog on the subject: http://systemcenterinfo.blogspot.com/2008/05/opsmgr-monitoring-event-log-part-1.html

share|improve this answer
    
Thanks Sam, I'm trying that now. Another question...... Should the event be visible in SCOM immediately or will there be a delay of 12-15 mins? –  Jacques Nov 5 '09 at 17:27
    
I'm having trouble finding any documentation on the Microsoft site. Hopefully you have it with the install media, but there may be a setting on polling interval. –  Sam Nov 5 '09 at 19:51
    
But I would test by setting up the monitoring and then logging in through SSMS with an invalid login and invalid password. –  Sam Nov 5 '09 at 19:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.