{"id":112534,"date":"2026-09-02T12:00:00","date_gmt":"2026-09-02T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=112534"},"modified":"2026-08-25T08:45:19","modified_gmt":"2026-08-25T08:45:19","slug":"sql-server-login-failures-how-to-monitor-report-and-alert-on-them-complete-guide","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/databases\/sql-server\/sql-server-login-failures-how-to-monitor-report-and-alert-on-them-complete-guide\/","title":{"rendered":"SQL Server login failures: how to monitor, report, and alert on them (complete guide)"},"content":{"rendered":"\n

Failed logins are one of the clearest early-warning signs of trouble on a SQL Server – whether that’s a misconfigured connection string, an expired password, or an actual unauthorized access attempt. Yet, by default, SQL Server won’t proactively tell you<\/em> when they happen; you have to go looking.<\/strong><\/p>\n\n\n\n

This guide walks through how to pull login failure data using sys.xp_readerrorlog<\/code>, filter it by time and error type, parse it into readable columns, aggregate repeat offenders, and automatically email a summary report \u2014 turning a passive log file into an active security and troubleshooting tool.<\/strong><\/p>\n\n\n\n

Data security<\/a> is an ever-present concern in the world of databases, keeping us up late at night far more often than we would like! Of the many types of monitoring and alerting<\/a> that can be implemented, the simplest and most effective are those around login failures.<\/p>\n\n\n\n

If users, apps, or services are trying to access data and are failing the login process, that is immediate evidence of a problem. It may be anything from be a legitimate security threat, to an app bug, a configuration error – or something else entirely.<\/p>\n\n\n\n

In this article, I’ll explain the many ways to alert and report on login failures, and how to use that information to improve security and application quality. I’ll also describe real failure scenarios, including what causes them and the implications they may have.<\/p>\n\n\n\n

\n
\n\n

You may also be interested in…<\/strong><\/p>\n\n\n\n

Simple Talk’s full archive of data security, privacy and compliance articles and guides<\/a><\/p>\n\n<\/div>\n<\/div> \n\n\n

What is a SQL Server login failure?<\/h2>\n\n\n\n

When we think of failed logins, a simple vision appears: we’re trying to log in to a server, get an error message, and then the head-scratching begins. Most of us have received messages like this before:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In reality, failed logins can happen any time, for a wide variety of reasons. More importantly, if we\u2019re not looking<\/em> for these failures, it\u2019s likely that nobody is even seeing them! <\/p>\n\n\n\n

In SQL Server, login failures are logged by default to the SQL Server error log – where they can be reviewed, alerted on, and reported on, at any time.<\/strong><\/p>\n\n\n\n

What causes a SQL Server login failure?<\/h2>\n\n\n\n

A failed SQL Server login typically indicates a problem that is worth checking. These problems can include:<\/strong><\/p>\n\n\n

\n