SQL login attempts

["Don" <Don () WeberOnTheWeb com>]

the alerting for SQL login attempts, shouldn't that alert be reversed, such
as alert on the attempted login, instead of alerting for the reply of sa
login failed. currently, i am getting the alerts for the response from my
sql that the login failed, so MY system shows up in the reporting, instead
of the offending system. anyone have a rule set that alerts on the attempt
instead of the response to the attempt?
thanks in advance

Don


_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users