What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Does PRTG do log monitoring for failed login attempts and abnormal login times?

Votes:

0

I would like to show all user attempts and if a user fails login 3 times it will send an alert / or display.

If work hours are from 8:00 - 17:00 and a user logs in at 01:00 it will send an alert / or display.

log prtg security

Created on Nov 18, 2022 7:04:52 AM



3 Replies

Votes:

0

Hello there.
Thank you for reaching us
PRTG can monitor the login attempts on different servers as long as they support this kind of monitoring.
What server are you interested in monitoring?
Some of our costumers like to monitor their DCs
Here are some examples
https://kb.paessler.com/en/topic/77434-how-to-monitor-logon-attempt-error https://kb.paessler.com/en/topic/49123-monitor-failed-logins-via-event-viewer

Regarding your second question. There is no easy way to do this, as there are some limitations of what PRTG can notify you about just as mentioned in the KB articles.

Regarding the notification time, I guess you could play with schedules.
Here is a crazy idea.
You can have two Event Viewer sensors ( just as described in the KB articles I shared) monitoring the same target. Give the sensor a meaningful name, for example, PRTG web server login failed working hours. For the second one, do the same, but make sure to include "non-working hours". Create 2 notification templates, with 2 different schedules,(https://www.paessler.com/manuals/prtg/schedules_settings) One for working hours, and the second one for non-working hours. Assign these notification templates to the triggers for each sensor accordingly. Both of the sensors will be actively monitoring the target at the same time, but just one will be sending notifications depending on the schedule assigned on the notification template for each sensor.
I hope this makes sense.

Created on Nov 23, 2022 3:21:35 AM by Luis Quesada (Paessler Technical Support)



Votes:

0

Hi! First of all thank you. I appreciate the detail and explanation provided.

We would like to track logins / failed logins on SUN system application used in finance when they login. (via Application)

Would it be possible or has this been done before other customers? I would appreciate if you can guide me as how to build a sensor specifically for this.

Looking forward to your reply!

Created on Nov 23, 2022 8:05:39 AM



Votes:

0

Hello Matthew Unfortunately, we don't have a record of doing this in the past for this particular System.
Since we are not sure how this system works it would be hard for us to know how to suggest a solution.
Perhaps, If you are able to get someone to write you a Powershell Script that is supported by the target system and provide you with this information, then it should be possible to create a sensor for it and make it work.'

Created on Dec 2, 2022 6:59:31 PM by Luis Quesada (Paessler Technical Support)




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.