0

I am working on event logs. I receive different logs such as 1. Success audit 2. Failure audit For same type of events(Login,logoff) etc. What exactly is the difference between these two types of events?

Audit Log Success

Audit Log Failure

1

A success audit entry is created in the event logs when a user logs on onto the computer/network with correct credentials, often, a username and password, and passes authentication.

A failure audit entry is created in the event logs when a user fails to pass authentication, with or without the credentials.

That said, a number of failure audits in succession of each other, against the same username, may also indicate someone is trying to brute force the password of the account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.