Sophos login test failure not reflected
I managed to receive the logs from Sophos from Database server.
Steps mainly comprises of
- Downloading jdbc into SSIM
- SSIM Sophos setting(password, database name, URL, directory of where JDBC is)
- Event query
- Logs from Sophos s1 and s2
My problem is when i do a login test failure on the database name. It is not reflected on the event query, Only information about the collector is grab.
Any reason, this is so?