All,
Am new to Solarwinds LEM.
Can someone please guide me on how to create an alert for all logins be it failed or successful from 1am to 6am.
I am kind of list when trying to create.
Thank You,
Solarwinds SEM Guidance Required
-
First you must make a time of day group from 1am to 6am this is under configure time of day group
Second make sure the auditing for success and failure is enable this varies on OS windows it under group policy to make sure that it tracked.
Recommend narrow to select system first for trial to clean up noise aka false positive for exceptions
make two rules for better tweaking
Failed Attempts
Successfully attempts
Narrow to select machine you want as this can get very noisy until proper filter can be done.