Audit failed logins

Hello:
I am trying to enable failed login attempt auditing and have succeeded with
by using a trace and event log alerts. The problem is there is no IP address
in the trace or alters. I have selected the "Host Name" column in profiler
but it only lists the hosts for successful logins, kind of pointless.
Any ideas on how I can get the IP address of failed login attempts?
Thanks.Hi,
SQL Server will not get IP Address of the Hosts machines. Probably you could
use the utilities like NETMON to track the IPAddress.
Thanks
Hari
SQL Server MVP
"emde" <emde@.na.com> wrote in message
news:%23XFJ8kjNFHA.3380@.TK2MSFTNGP15.phx.gbl...
> Hello:
> I am trying to enable failed login attempt auditing and have succeeded
> with
> by using a trace and event log alerts. The problem is there is no IP
> address
> in the trace or alters. I have selected the "Host Name" column in profiler
> but it only lists the hosts for successful logins, kind of pointless.
> Any ideas on how I can get the IP address of failed login attempts?
> Thanks.
>
>|||As Hari has pointed out, you can't do this in SQL2000 however in SQL2005,
the IP address is logged in the SQL Errorlog for failed logins.
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"emde" <emde@.na.com> wrote in message
news:%23XFJ8kjNFHA.3380@.TK2MSFTNGP15.phx.gbl...
> Hello:
> I am trying to enable failed login attempt auditing and have succeeded
> with
> by using a trace and event log alerts. The problem is there is no IP
> address
> in the trace or alters. I have selected the "Host Name" column in profiler
> but it only lists the hosts for successful logins, kind of pointless.
> Any ideas on how I can get the IP address of failed login attempts?
> Thanks.
>
>|||Good news. Hopefully this feature will be backported to SQL2000 in a future
service pack!
"Jasper Smith" <jasper_smith9@.hotmail.com> wrote in message
news:%23rKrNUoNFHA.1396@.TK2MSFTNGP10.phx.gbl...
> As Hari has pointed out, you can't do this in SQL2000 however in SQL2005,
> the IP address is logged in the SQL Errorlog for failed logins.
> --
> HTH
> Jasper Smith (SQL Server MVP)
> http://www.sqldbatips.com
> I support PASS - the definitive, global
> community for SQL Server professionals -
> http://www.sqlpass.org