Is there any way to see failed login attempts?

[Jason Stephens]

I have users complaining that they can't log in. I would like to verify that they are using the correct credentials. Of course I could just ask them, but I was curious if I could see this information on the system...

[Garrick]

jasonstephens

I'm thinking a Script Action that fires on the Event login.failed could update a new table that captures the attempts. Perhaps one of our scripting gurus can suggest how that'd look. The event login.failed is already there (used for login lockouts), just have to create the table and script.

http://wiki.service-now.com/index.php?title=Script_Actions

[ctu1]

Hi,

if you're using LDAP authentication you can find that information in the LDAP Log (which is basically the System Log filtered for source LDAP) like in the screenshot. Note: yours might be slightly different depending on the LDAP you use.

Regards,
CT

[Garrick]

jasonstephens

Whoops. Don't bother with my table/script idea. It's already there! Go to the Event Log in System Policy and filter on the name login.failed. You'll see time/date, IP, and what they attempted to use as a username. If you'd like, create a simple module as part of User Administration that points to that filter.

Attached a screen shot.

[Jason Stephens]

That's exactly what I needed - thank you very much for the help.