Avoiding the XP_cmdshell

  • Hi All,

    I have created one trigger on the table which would identify the hostname,username,app_name for any update or delete command.Now I need to get the Ipaddress also.But I am reluctant for using the XP_cmdshell due to security concerns.

    Is there any other TSQL solution to get the IPaddress of the m/c?

  • Hi,

    Refer the below link, see RBarryYoung approach on this.

    http://qa.sqlservercentral.com/Forums/Topic473301-169-1.aspx

  • Hi,

    Thanks for the reply.I tried RBarry Young's approach but didn't work for me.The sytem view is not giving the actual m/c IP address.I checked my m/c Ip address but didn't find in this view.It shows some other IP address for the sp id of current process.

  • If you are on SS2005, then the only reason that I could think of for this is that they are not connecting through TCP/IP. Normally that would mean either that the clients were local (i.e., on the Server) or using Named Pipes.

    [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
    Proactive Performance Solutions, Inc.
    [/font]
    [font="Verdana"] "Performance is our middle name."[/font]

  • The client_net_address should represent the address of the client machine making the connection. If you're connecting directly from your machine it should show your address. If you're connecting through, say, a web app, it would show the connecting machine, like a web server. If you want the IP of the computer connected to the web app, you should pass that in from the front end.

  • SQLPirate (1/21/2010)


    The client_net_address should represent the address of the client machine making the connection. If you're connecting directly from your machine it should show your address. If you're connecting through, say, a web app, it would show the connecting machine, like a web server. If you want the IP of the computer connected to the web app, you should pass that in from the front end.

    That's the "RBarryYoung" technique that they have been talking about (follow the link above).

    [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
    Proactive Performance Solutions, Inc.
    [/font]
    [font="Verdana"] "Performance is our middle name."[/font]

  • RBarryYoung (1/21/2010)


    SQLPirate (1/21/2010)


    The client_net_address should represent the address of the client machine making the connection. If you're connecting directly from your machine it should show your address. If you're connecting through, say, a web app, it would show the connecting machine, like a web server. If you want the IP of the computer connected to the web app, you should pass that in from the front end.

    That's the "RBarryYoung" technique that they have been talking about (follow the link above).

    And to give credit where credit is due, I think that I actually learned this from Brian Kelley.

    [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
    Proactive Performance Solutions, Inc.
    [/font]
    [font="Verdana"] "Performance is our middle name."[/font]

  • That's the "RBarryYoung" technique that they have been talking about (follow the link above).

    I wasn't trying to steal your thunder, that's where I learned it from 😀

    I was just trying to explain why the IP address shown may not be the one expected. Sorry for any confusion.

Viewing 8 posts - 1 through 7 (of 7 total)

You must be logged in to reply to this topic. Login to reply