Using event notification for logon auditing, I am getting multiple records for the same event. Is there a way to limit to a single record per event. For event type AUDIT_LOGON_FAILED, a single record is returned for an event, however, for AUDIT_LOGON, multiple records are returned per event.

Please help avoiding retrieving multiple records for a single logon event. Or what other alternative exists for capturing failed login attempts. I am trying to automate the process and reporting.

Any help will be appreciated.