Forum Discussion

Patrick Taft's avatar
Patrick Taft
Copper Contributor
May 10, 2018

Audit Log changes

Like many users, we had IP ranges in Nigeria  trying to crack user passwords, and this was showing up in the Audit Logs as "UserLoginFailed"  now this seems to have disappeared completely.  I tried f...
Auditing
VasilMichev's avatar
VasilMichev
MVP
May 11, 2018

I can see them just fine in the SCC. There's no pre-built filter for "failed login" events though, so you have to get the full list and sort/filter it in Excel or similar.

Patrick Taft's avatar
Patrick Taft
Copper Contributor
May 11, 2018

Yes, agreed,. but I was seeing a lot when I filtered,. now literally zero.  just seems strange that they stopped trying to access accounts.  I was concerned that something changed and just not seeing it now. I was getting UserLoggedIn and UserLoginFailed entries.   Thank You

  • Patrick Taft's avatar
    Patrick Taft
    Copper Contributor
    May 11, 2018

    I have the CSV that I had pulled on 3/22, a 24 hour log,. 50,000 entries.  of that there are 3564 UserLoggedIn entries and 492 UserLoginFailed entries.  I pulled a log on 5/10 15 hours, 33k entries, not a single UserLoggedin or UserLoginFailed entry.

    • VasilMichev's avatar
      VasilMichev
      MVP
      May 11, 2018

      Well if you don't even see UserLoggedin event, that calls for a support case...

Resources