This might be easy one, but it seems i am unable to figure out the way to capture only those failed logins:

Which have failed with error ” Login failed for user X. The password did not match…..”

Yes i can read that info out from sql error logs and event viewer but the problem is on some servers due to space constraints we are not keeping those many frequent error logs. Moreover what i am trying to achieve here is the Culprit host or application which is trying to connect with bad password and later gets the account locked out. Therefore after some time when we try to review the error log messages are full with lock out, but basic password mismatch error log is truncated.

Is there a way to only capture/track and save the information related to bad password attempts for those logins and capturing required details?

Thanks