I'm new to SCOM 2007. Im trying to setup alerts and views for failed SQL login attempts. I've been on the internet for hours without any luck.

My test case is trying to connect to SQL server on the same machine with invalid login details.

Can someone please give me step by step instructions to accomplish this?


  • are you still looking for an answer to this? – SQLRockstar Mar 10 '10 at 5:24

I'm not familiar with SCOM, but these failures will show up in your application event log as this:

Event Type: Failure Audit
Event Source:   MSSQLSERVER
Event Category: (4)
Event ID:   18456
Date:       11/5/2009
Time:       9:33:49 AM
User:       N/A
Computer:   DEVMSSQL
Login failed for user 'bad_login'. [CLIENT:]

I would assume SCOM has facilities for alerting on event log entries of a certain ID.

Here is a blog on the subject: http://systemcenterinfo.blogspot.com/2008/05/opsmgr-monitoring-event-log-part-1.html

  • Thanks Sam, I'm trying that now. Another question...... Should the event be visible in SCOM immediately or will there be a delay of 12-15 mins? – Jacques Nov 5 '09 at 17:27
  • I'm having trouble finding any documentation on the Microsoft site. Hopefully you have it with the install media, but there may be a setting on polling interval. – Sam Nov 5 '09 at 19:51
  • But I would test by setting up the monitoring and then logging in through SSMS with an invalid login and invalid password. – Sam Nov 5 '09 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy