Authentication and Password Security - Implementing Database Security and Auditing - page 116

Figure 4.7
Creating an alert
that sends an e-
mail when failed
logins go over a
threshold of five.
Figure 4.7). Figure 4.7 shows a definition of an alert that is based on count-
ing failed login events (the query) over a period of one hour and sending an
e-mail notification to the DBA (the alert receiver) whenever the number of
failed logins goes over a defined threshold (in this case the number is five).
Regardless of whether you want active notification or whether you'll just
periodically look at a report, you need a simple way to monitor these
events. This can be done inside the database using native audit or trace fea-
tures or by using an external security monitor that looks at all SQL calls and
status codes communicated between clients and servers.