I setup SQL Server Alerts to send me emails whenever certain events (by severity) occur. Below is an example of en email I received for a "014 - Insufficient Permission" severity event of Type "SQL Server event alert." I looked in the Error Log as well, but no more detailed information can be found.

DATE/TIME:      1/9/2013 3:38:01 PM

DESCRIPTION:    Login failed for user 'DOMAIN\username'. [CLIENT: <local machine>]

COMMENT:        (None)

JOB RUN:        (None)

I want to increase the level of detail provided in these alerts to make it easier to debug and resolve issues. How can I accomplish this?

  • what more do you need to know? The named user failed login... – Mitch Wheat Jan 10 '13 at 6:37
  • @MitchWheat For example, the Server they were trying to login to? What application were they using? Etc. In this case the user is a utility account which is using SQL Server authentication and is used for many of our applications to connect to various databases. – Chiramisu Jan 10 '13 at 6:43
  • What version of SQL Server are you using? – mrdenny Jan 10 '13 at 7:55
  • 1
    There's not going to be anything you can really add then. If you were using SQL 2008 or higher you could look at extended events and gather data that way. You can put the server name in the FROM field when you configure the email. The application they are using isn't going to be available to you. – mrdenny Jan 10 '13 at 22:23
  • 1
    Auditing wasn't really worried about until SOX came around which happened about 2003 or so. By then the feature set was locked and additional auditing couldn't be added into the product. – mrdenny Jan 12 '13 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.