Forum Discussion

Will_Pratt's avatar
Will_Pratt
3 years ago

I need to alert for 20 consecutive failed logon attempts within a 30 minute time period

We have a team that would like to get alerted on 20 consecutive failed logon attempts from a single account on any of our SQL servers in a 30 minute time frame. I started out using the eventsource ...
edward_garza's avatar
edward_garza
11 months ago

If the SQL logs are ingested into LM Logs and the failed SQL login attempts are logged, then yes, you can set a log alert to notify when 20 failed SQL login attempts are seen in the log files within a 30 minute period.