Return
-
Title
SQL Audit Login Failed events do not include user SID and must be searched/purged using LIKE filter if using the WHO tab as matching criteria -
Description
SQL Audit Login Failed events must be searched/purged using LIKE filter if using the WHO tab. -
Cause
Change Auditor for SQL events are generated based on SQL trace. The native tracing does not contain a value under the 'LoginSid' column value for the event class 'Audit Login Failed'. This value would typically populat the 'UserSID' value in the corresponding Change Auditor event(s). -
Resolution
To search for events related to 'Audit Login Failed' using the WHO tab:Use the LIKE option specified as 'Domain\UserName' format. This will not lock the search to the AD 'UserSID' field but instead look to the 'UserName' field.To purge events related to 'Audit Login Failed' using the WHO tab:Use the LIKE option specified as 'Domain\UserName'. This will not lock the search to the AD 'UserSID' field but instead look to the 'UserName' field.