Argthtjtr

I'm never sure if this is the right place to ask, but if not please let me know.

So I have to get a list of FTP failed authentication logs, more specifically get the IPs where they originated. Software independent that is, so I won't get them from a folder or so, they should come from Event Viewer.

But I haven't found any events that are meant specifically for this purpose and I don't know for sure they exist.

I have some code (most of it was copied from another question which I don't remember the name of), to retrieve event information in xml format, from where I then retrieve substrings with the IPs and names of users. Here are the functions:

public string QueryActiveLog()

        {

            string res = "";

        string queryString = @"

                     <QueryList>

                        <Query Id='0' Path='Security'>

                         <Select Path='Security'>*[System[(EventID=4624)]] and *[EventData[Data[@Name='IpAddress']!='-']]</Select>

                        </Query>

                     </QueryList>";



            EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);

            EventLogReader logReader = new EventLogReader(eventsQuery);



            // Display event info

            res = DisplayEventLogInformation(logReader);



        return res;

    }

    public string DisplayEventLogInformation(EventLogReader logReader)

    {

        string res = "";



        for (EventRecord eventInstance = logReader.ReadEvent(); null != eventInstance; eventInstance = logReader.ReadEvent())

        {

            EventLogRecord logRecord = (EventLogRecord)eventInstance;

            res += logRecord.ToXml() + Environment.NewLine + Environment.NewLine;

        }



        return res;

    }



    /// <summary>

    /// orig -> original string // Options for args: "ip" -> get IPs from string, "user" -> get user names from string

    /// </summary>

    /// <param name="orig"></param>

    /// <param name="args"></param>

    /// <returns></returns>

    public List<string> getSubstrings(string orig, string args)

    {

        int index1 = 0, index2 = 0;

        List<string> subres = new List<string>();



        switch (args)

        {

            case "ip":

                while (index2 < orig.LastIndexOf("<Data Name='IpAddress'>"))

                {

                    index1 = orig.IndexOf("<Data Name='IpAddress'>", index2) + 23;

                    index2 = orig.IndexOf("</Data>", index1);

                    subres.Add(orig.Substring(index1, index2 - index1));

                }

                return subres;



            case "user":

                while (index2 < orig.LastIndexOf("<Data Name='SubjectUserName'>"))

                {

                    index1 = orig.IndexOf("<Data Name='SubjectUserName'>", index2) + 29;

                    index2 = orig.IndexOf("$</Data>", index1);

                    subres.Add(orig.Substring(index1, index2 - index1));

                }



                return subres;



            default:

                subres.Add("Invalid option");

                return subres;

        }

    }

Here the event it's getting its information from is 4624 (just as an example), my question is if there is an event specifically for instances of failed FTP authentication so I can use it in this format.

EDIT

As suggested by Martin Prikryl, to clarify, I'm on the server side and want to get notified for when a client tries to access my server and fails, independently of what software the client is using.