I am working on event logs. I receive different logs such as 1. Success audit 2. Failure audit For same type of events(Login,logoff) etc. What exactly is the difference between these two types of events?
A success audit entry is created in the event logs when a user logs on onto the computer/network with correct credentials, often, a username and password, and passes authentication.
A failure audit entry is created in the event logs when a user fails to pass authentication, with or without the credentials.
That said, a number of failure audits in succession of each other, against the same username, may also indicate someone is trying to brute force the password of the account.