{"name":"Failed SQL Server logins","description":"This metric returns the number of 'login failed' error messages found in the SQL Server error log file in the last hour.","tsql":"DECLARE @endtime DATETIME;\r\nSET @endtime = GETDATE();\r\n\r\nDECLARE @starttime DATETIME;\r\nSET @starttime = DATEADD(hh, -1, @endtime);\r\n\r\nIF OBJECT_ID('tempdb..#LogEntries') IS NOT NULL\r\n    DROP TABLE #LogEntries;\r\n\r\nCREATE TABLE #LogEntries\r\n    (\r\n      LogDate DATETIME ,\r\n      ProcessInfo VARCHAR(1000) ,\r\n      LogMessage TEXT\r\n    );\r\n\r\nINSERT  INTO #LogEntries\r\n        EXEC sys.xp_readerrorlog 0, 1, N'Login', N'failed', @starttime, @endtime;\r\n    \r\n\r\nSELECT  COUNT(*)\r\nFROM    #LogEntries;\r\n\r\nDROP TABLE #LogEntries;","instances":true,"frequency":3600,"databases":{"mode":1},"rateofchange":false,"metricenabled":true,"alertname":"Failed SQL Server logins","alertdescription":"This alert is raised when SQL Monitor detects one or more failed SQL Server logins in the last hour.","aboveorbelow":"above","collections":1,"alertenabled":true,"_thresholds_high":{"selected":true,"value":0},"tsql_comment":"Note: This T-SQL reads the last hour of data from the current log file. If your log file rolls over more frequently than every hour, you'll need to update the SQL statement to match that frequency. For example, if the file rolls over every 30 minutes, you'd change hh, -1 to mi -30.","frequency_comment":"Note: If you've updated the T-SQL to read from the file more frequently, you should update the metric collection frequency to match.","_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"targetentitytype":0}