Alexander Suprun (9/24/2014)

---

Don't need to run a trace, simply use the default one (if enabled). Then you can get ApplicationName and ProcessID.

Use this query:

DECLARE @filename VARCHAR(500)

SELECT @filename = SUBSTRING(path, 0,LEN(path)

- CHARINDEX('\',REVERSE(path)) + 1)+ '\Log.trc'

FROM sys.traces

WHERE is_default = 1 ;

SELECT

te.Name AS EventName

,NTDomainName

,NTUserName

,LoginName

,ApplicationName

,HostName

,ClientProcessID AS ProcessID

,DatabaseName

,StartTime

,TextData

,Error

,SPID

,SessionLoginName

FROM fn_trace_gettable(@fileName, DEFAULT) gt

INNER JOIN sys.trace_events te ON EventClass = te.trace_event_id

WHERE EventClass IN(20) -- Audit Login Failed

ORDER BY StartTime DESC