monitoring-failed-sql-server-login-requests

monitoring-failed-sql-server-login-requests_1.ps1

Import-Module SQLPS -DisableNameChecking

#replace your with your instance name
$instanceName = "server\instance";
$srv = New-Object -TypeName Microsoft.SqlServer.Management.Smo.Server -ArgumentList $instanceName;

monitoring-failed-sql-server-login-requests_2.ps1

$srv.ReadErrorLog() |
Where ProcessInfo -like "*Logon*" |
Where Text -like "*Login failed for*" | 
Format-List

monitoring-failed-sql-server-login-requests_3.ps1

$srv.ReadErrorLog() |
Where { ($_.LogDate.Date -eq (Get-Date).Date) -and ($_.ProcessInfo -like "*Logon*") -and ($_.Text -like "*Login failed for*")} | 
Group Text | Where { ($_.Count -gt 5)}|Sort count -Descending | Format-Table Count, Name