From eDirectory version 888Patch9 and 902 we can monitor successful and failed login events through XDAS auditing with the help of the latest eDirectory Collector (2011.1r7) and NMAS Collector (2011.1r4). Modify the Directory System to report the LOGIN and AUTHENTICATE events separately. Add two new DS events DSE_LOGIN_EX (mapped to Create Session XDAS event) and DSE_AUTHENTICATE (mapped to Authentication Session XDAS event) which are used for Login and Authentication. These new events are only used by XDAS.

Also XDAS instrumentation provides reasons for login failures like "Login Failed" for the wrong password, “Account Expired” for Account disabled, and “Account Locked” for account locked due to intruder detection.

Steps to monitor successful and failed login events:

1. Install and configure 888Patch9/902 eDirectory server.
   

• Install and configure Sentinel server with the latest eDirectory and NMAS collector.
  

• Enable the XDAS auditing for eDirectory and NMAS component. Check the links below for more detail:
  
  Auditing eDirectory events: https://www.netiq.com/documentation/edir88/edirxdas_admin/data/brpq3ik3.html
  
  Auditing NMAS events: https://www.netiq.com/documentation/nmas33/admin/data/bwmt40o.html
  

• Select XDAS events "Create Session" and "Authentication Session" for monitoring through iManager.
  

• Use the latest eDirectory and NMAS collector from https://www.netiq.com/support/sentinel/plugins/
  

Now setup is ready for monitoring successful and failed login events.

Check the screen shot below of Sentinel view of a login event for both a successful login and a failed login.