Forum Discussion

Will_Pratt's avatar
Will_Pratt
3 years ago

I need to alert for 20 consecutive failed logon attempts within a 30 minute time period

We have a team that would like to get alerted on 20 consecutive failed logon attempts from a single account on any of our SQL servers in a 30 minute time frame. I started out using the eventsource ...
Shack's avatar
Shack
Icon for Advisor rankAdvisor
10 months ago

Will the complex filter option within an event source let you script a number of occurrences value or is it still just for basic filtering?

I don't have LM Logs but would like to be able to account for a a bunch of consecutive failed logons but ignore when it occasionally happens.

Cant use PowerShell unfortunately.

Anonymous's avatar
Anonymous
10 months ago

Not with the filter option built in. But you could use the script cache to remember the last few polls and get a rolling sum of failed logins. It's more of a datapoint, but then you'd alert whenever the failures surpassed your threshold.