use master;
SELECT	top 100
	te.name, 
	ft.SPID,
	ft.LoginName,
	ft.Hostname,
	ft.ClientProcessID,
	ft.DatabaseName, 
	ft.FileName, 
	ft.StartTime, 
	dateadd(ms,ft.Duration/1000,ft.StartTime) [FinishTime],
	ft.ApplicationName ,
	ft.ObjectID,
	ft.Duration/1000/1000 [Duration (s)],
	ft.TextData,
	ft.RoleName,
	ft.TargetUserName,
	ft.TargetLoginName
FROM sys.traces st CROSS Apply
	::fn_trace_gettable(reverse(stuff(reverse(st.path),1,charindex('_',reverse(st.path)),'crt.')), st.max_files) AS ft 
INNER JOIN sys.trace_events AS te ON ft.EventClass = te.trace_event_id 
WHERE 
	te.name LIKE 'Audit Login Failed'  
	and st.is_default=1 
	and st.status=1
ORDER BY ft.StartTime desc;