DECLARE @filename VARCHAR(500) 
SELECT @filename = SUBSTRING(path, 0,LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)+ '\Log.trc'
FROM sys.traces
WHERE is_default = 1 ;

SELECT
  te.Name AS EventName
  ,StartTime
  ,NTDomainName
  ,NTUserName
  ,LoginName
  ,ApplicationName
  ,HostName
  ,DatabaseName
  ,TextData
  ,SPID
  ,SessionLoginName
  ,Error
  ,Success
  ,IsSystem
FROM fn_trace_gettable(@fileName, DEFAULT) gt 
  INNER JOIN sys.trace_events te ON EventClass = te.trace_event_id 
WHERE EventClass IN(20) -- Audit Login Failed
ORDER BY StartTime DESC