Submit a ticketCall us

Announcing NPM 12.2
With NPM 12.2 you can monitor your Cisco ASA firewalls, to monitor VPN tunnels for basic visibility and troubleshooting tunnels. NPM 12.2 also uses the SolarWinds Orion Installer so you can easily install and upgrade one or more Orion Platform products simultaneously.
See new features and improvements.

Home > Success Center > Server & Application Monitor (SAM) > Create a Report on Captured Account Lockout Event Logs

Create a Report on Captured Account Lockout Event Logs

Table of contents
Created by Tiarnan Stacke, last modified by MindTouch on Jun 23, 2016

Views: 373 Votes: 1 Revisions: 4

Overview

This article provides steps on how to create a report on Account Lockout Events which are captured by SAM.

Environment

All Versions of SAM

Detail

First, apply the Windows Domain Controller Template to your DC in SAM

 

Please see this link for steps on how to apply the template to your DC Node.

 

Creating the Report:

  1. Open the Orion Web Console.
  2. Go to the Settings page > Manage Reports > Create New Report.
  3. Choose the Custom Table Resource.
  4. Select and continue.
  5. Change the Selection Method to Advanced DataBase Query (SQL, SWQL).
  6. Change the Radial button to SQL.
  7. Paste the following SQL Query into the window

    2008/2012 Domain Controller
    SELECT TOP 1000 [ComponentID]
          ,[LogFile]
          ,[RecordNumber]
          ,[ComponentStatusID]
          ,[EventType]
          ,[EventCode]
          ,[TimeGeneratedUtc]
          ,[ComputerName]
          ,[SourceName]
          ,[User]
          ,[Message]
    FROM APM_WindowsEvent_Detail
    WHERE EventCode = '4740'
    ORDER BY TimeGeneratedUtc DESC


    2003 Domain Controller
    SELECT TOP 1000 [ComponentID]
          ,[LogFile]
          ,[RecordNumber]
          ,[ComponentStatusID]
          ,[EventType]
          ,[EventCode]
          ,[TimeGeneratedUtc]
          ,[ComputerName]
          ,[SourceName]
          ,[User]
          ,[Message]
    FROM APM_WindowsEvent_Detail
    WHERE EventCode = '539'
    ORDER BY TimeGeneratedUtc
    DESC
  8. Click Add to Layout.
  9. Add all of the columns you want to see in the report.
  10. Save the changes and save the report.

 

If you want to schedule this report in an email, follow the steps in this document.

 

Last modified
02:49, 23 Jun 2016

Tags

Classifications

Public