Capturing the Login Failure alerts specifc to bad password attempts I am unable to figure out the way to capture only those failed logins, which have failed with the error:


  Login failed for user X. The password did not match...


Yes I can read that info out from SQL Server error logs and Event Viewer, but the problem is on some servers due to space constraints we are not keeping frequent error logs.

Moreover, what I am trying to achieve here is to find the culprit host or application which is trying to connect with a bad password and later gets the account locked out. Therefore after some time when we try to review the error log messages are full with lock out, but basic password mismatch error log is truncated.

Is there a way to only capture/track and save the information related to bad password attempts for those logins and capturing required details?
You should be able to setup an extended event and use either the generic error_reported event or process_login_finish (I'm not sure if process_login_finish is available in SQL Server 2014).

There's an article detailing a few different options at Using Extended Events to review SQL Server failed logins written in 2014 by Ivan Stankovic.