Can anybody help. I am new to WMI.
I am trying to create an alert for trace event 162 - User Error Message
I already have standard alerts for Login failed for user - 18452, 18456, 18457. The problem is that these errors don't tell you the 'real' database the user is trying to log into. They show the database as master.
The other day I started a profiler trace and looked for event 162 - User Error Message and 20- Login Failed. In the trace file I saw messages like
- Cannot open database "<DATABASENAME>" requested by the login. The login failed.- 2014-07-22 20:05:56.60 Logon Error: 18456, Severity: 14, State: 38. 2014-07-22 20:05:56.60 Logon Login failed for user '<UserName>'. Reason: Failed to open the explicitly specified database. [CLIENT: xxx.xxx.xxx.xxx]
- Login failed for user '<UserName>'. Reason: Failed to open the explicitly specified database. [CLIENT: xxx.xxx.xxx.xxx]
- Login failed for user '<UserName>'.
The first error is is event 162 and contains my database name. The error number for this error is 4060.
Is there any way to create a SQL Server alert for this event/error and capture the text string? I tried standard alerts but was un successful so I thought WMI might be the answer.
Is there a wmi class for user error messages? Does anybody have any ideas on how to get this to work?