Forum Discussion

Will_Pratt's avatar
Will_Pratt
3 years ago

I need to alert for 20 consecutive failed logon attempts within a 30 minute time period

We have a team that would like to get alerted on 20 consecutive failed logon attempts from a single account on any of our SQL servers in a 30 minute time frame. I started out using the eventsource ...
Shack's avatar
Shack
Icon for Advisor rankAdvisor

Will the complex filter option within an event source let you script a number of occurrences value or is it still just for basic filtering?

I don't have LM Logs but would like to be able to account for a a bunch of consecutive failed logons but ignore when it occasionally happens.

Cant use PowerShell unfortunately.

Anonymous's avatar
Anonymous
3 months ago

Not with the filter option built in. But you could use the script cache to remember the last few polls and get a rolling sum of failed logins. It's more of a datapoint, but then you'd alert whenever the failures surpassed your threshold.