auditing user "sa" failed attemps

From: Lance B (labell@gov.mb.ca)
Date: 05/27/02 

From: "Lance B" <labell@gov.mb.ca>
Date: Mon, 27 May 2002 10:25:34 -0700

I have tried to audit user access / failed attempts.
Hoever, with NT Server 4 SP6A and sqlserver7 sp3, the
failed attempts do not register in the application log
unless I use the check box set to success or all. When
these are set only the failed attempts are logged. When
set to failed there is no log entry.

Does anyone know if this is a bug or do I have to set the
severity level or audit level to something other than than
the default. If so how or where is this documented.

Any help would be appreciated, thanks
Lance B.