NMP - SAM - SQL monitoring and SQL Events related alerts

adpanssw

Hello everyone, 

I'm exploring the SAM AppInsight for the SQL. I noted that system is pulling the data from the SQL event viewier. 

I was trying to setup an alert based on that event 18456 or phrase "Login failed", but so far no luck at least with below triggers. 

I noted that at the SQL template level there's a way to set warning or critical alerts for particular event ID, however it simply sends mail that alert was triggered, without any extra notification about event ID or message. 

So, is there a way to create an alert based on the SQL event / Windows Event viewer, to send notification upon event id 18456 (= login failed), ideally with message content that user X wasn't allowed to log in due to Y.

bobmarley

There is probably an easier way. Pull up the Node Details for your SQL server then launch Real Time Event Log Viewer, click on the event and then click Start Monitoring. This will create a new SAM template for you. Alternately, if the event is not in the log manually create a SAM template for that event ID.