ERROR 18456 not being logged in event viewer

Hi.
I made an alert that will email me whenever someone causes error 18456 to be
raised... My thinking behind this is that if anyones trying to access my
server and FAILS, then they are probably up to no good.
So anyway... This alert was created... I verified that SQL Server Agent
Mail is running, as is SQL Mail... so thats not the point of failure.
I just attempted to log in with sa and a fake password. It predictably did
not give me access to the databases, but the event was NOT logged to the
application log. I checked in enterprise manager, and the checkbox that
says "Always write to Windows eventlog" is checked.
I also verified that the SQL Server Agent is running under a local and
domain admin, and this is the case.
Does anybody have any ideas?
Thanks in advance,
-- Jason
I assume that this error number is failed login. If so, you handle this in a special way. EM, right-click your
server, security.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Jeigh" <folkens.jason@.acd.net> wrote in message news:CoydnaIo9LfTcVndRVn-gw@.giganews.com...
> Hi.
> I made an alert that will email me whenever someone causes error 18456 to be
> raised... My thinking behind this is that if anyones trying to access my
> server and FAILS, then they are probably up to no good.
> So anyway... This alert was created... I verified that SQL Server Agent
> Mail is running, as is SQL Mail... so thats not the point of failure.
> I just attempted to log in with sa and a fake password. It predictably did
> not give me access to the databases, but the event was NOT logged to the
> application log. I checked in enterprise manager, and the checkbox that
> says "Always write to Windows eventlog" is checked.
> I also verified that the SQL Server Agent is running under a local and
> domain admin, and this is the case.
> Does anybody have any ideas?
> Thanks in advance,
> -- Jason
>
|||Are you referring to the "Audit Level" raido buttons?
Changing it from "None" to "Failure" didnt seem to make that much of a
difference. Am I looking at the right thing?
Thanks,
-- Jason
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:O6NBB4STEHA.2416@.TK2MSFTNGP09.phx.gbl...
> I assume that this error number is failed login. If so, you handle this in
a special way. EM, right-click your
> server, security.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "Jeigh" <folkens.jason@.acd.net> wrote in message
news:CoydnaIo9LfTcVndRVn-gw@.giganews.com...[vbcol=seagreen]
to be[vbcol=seagreen]
my[vbcol=seagreen]
Agent[vbcol=seagreen]
did
>
|||Yep, that's the one I was referring to. So you don't see the events logged to eventlog, after checking the
checkbox. Strange, I know it work for me. Perhaps time to open a case with MS?
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Jeigh" <folkens.jason@.acd.net> wrote in message news:p7GdnZI30-avWFjd4p2dnA@.giganews.com...
> Are you referring to the "Audit Level" raido buttons?
> Changing it from "None" to "Failure" didnt seem to make that much of a
> difference. Am I looking at the right thing?
> Thanks,
> -- Jason
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:O6NBB4STEHA.2416@.TK2MSFTNGP09.phx.gbl...
> a special way. EM, right-click your
> news:CoydnaIo9LfTcVndRVn-gw@.giganews.com...
> to be
> my
> Agent
> did
>