1

I'm new to SCOM 2007. Im trying to setup alerts and views for failed SQL login attempts. I've been on the internet for hours without any luck.

My test case is trying to connect to SQL server on the same machine with invalid login details.

Can someone please give me step by step instructions to accomplish this?

Thanks

1 Answers1

1

I'm not familiar with SCOM, but these failures will show up in your application event log as this:

Event Type: Failure Audit
Event Source:   MSSQLSERVER
Event Category: (4)
Event ID:   18456
Date:       11/5/2009
Time:       9:33:49 AM
User:       N/A
Computer:   DEVMSSQL
Description:
Login failed for user 'bad_login'. [CLIENT: 0.0.0.0]

I would assume SCOM has facilities for alerting on event log entries of a certain ID.

Here is a blog on the subject: http://systemcenterinfo.blogspot.com/2008/05/opsmgr-monitoring-event-log-part-1.html

Sam
  • 2,020
  • 1
  • 16
  • 22
  • Thanks Sam, I'm trying that now. Another question...... Should the event be visible in SCOM immediately or will there be a delay of 12-15 mins? –  Nov 05 '09 at 17:27
  • I'm having trouble finding any documentation on the Microsoft site. Hopefully you have it with the install media, but there may be a setting on polling interval. – Sam Nov 05 '09 at 19:51
  • But I would test by setting up the monitoring and then logging in through SSMS with an invalid login and invalid password. – Sam Nov 05 '09 at 19:52