Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to SCOM 2007. Im trying to setup alerts and views for failed SQL login attempts. I've been on the internet for hours without any luck.

My test case is trying to connect to SQL server on the same machine with invalid login details.

Can someone please give me step by step instructions to accomplish this?


share|improve this question
are you still looking for an answer to this? – SQLRockstar Mar 10 '10 at 5:24

I'm not familiar with SCOM, but these failures will show up in your application event log as this:

Event Type: Failure Audit
Event Source:   MSSQLSERVER
Event Category: (4)
Event ID:   18456
Date:   	11/5/2009
Time:   	9:33:49 AM
User:   	N/A
Computer:   DEVMSSQL
Login failed for user 'bad_login'. [CLIENT:]

I would assume SCOM has facilities for alerting on event log entries of a certain ID.

Here is a blog on the subject:

share|improve this answer
Thanks Sam, I'm trying that now. Another question...... Should the event be visible in SCOM immediately or will there be a delay of 12-15 mins? – Jacques Nov 5 '09 at 17:27
I'm having trouble finding any documentation on the Microsoft site. Hopefully you have it with the install media, but there may be a setting on polling interval. – Sam Nov 5 '09 at 19:51
But I would test by setting up the monitoring and then logging in through SSMS with an invalid login and invalid password. – Sam Nov 5 '09 at 19:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.