One of the options to audit failed logins is to turn on the appropriate option in SQL Server in the Server Properties dialog (the Security node) of a SQL Server instance in Object Explorer.
The setting is on the instance level.
The SQL Server instance must be running to capture failed logins.
More information >> https://ibmimedia.com/blog/133/how-to-audit-failed-logins-in-sql-server
query to check failed login attempts in #sql server
sql server login auditing both failed and successful logins
sql profiler failed logins
sql server 2017 audit failed logins
sql server error 18456
sql server #audit user activity
sql server login history
sql server extended events failed login
