Post reply

SQL Server Audit

  • September 12, 2012 at 9:42 am

    #1536790

    Thanks .

    Could you please help me with server side trace,Can we run the trace 24x7? Any sample will be helpfull

  • September 12, 2012 at 11:28 am

    #1536858

    If you need someone with more experience to actually set this up for you, consdier grabbing a consultant or a DBA you know and trust. Believe me, I know anything new can be scary, and it's easier to ignore than to try something new.

    Like i mentioned in my post quoted here, I have this running on my servers, with a rollover 24-7; I also have a DML trace, capturing every command executed as well; the procedure sp_procoption (linky to Books Online) is what you use to set a procedure to be executed every time the server restarts.

    You need to do that, because except for the C2 Audit and the default DDL trace, all traces stop when the server restarts.

    server side traces have minimal impact, unlike a profiler session.

    If you really need it, myself or any of the frequent posters here could be hired as a consultant to get you set up ; or you could do a little bit of investigation and get yourself up to speed.

    Lowell (9/10/2012)

    here's a link to a Login trace I like to use for an example; you would need to make the procedure a startup procedure so it restarts when the server restarts. it also creates a view, so i can select from the trace anytime i want.

    sp_AddMyLogonTrace.txt

    Lowell

    --help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

  • September 12, 2012 at 11:54 am

    #1536860

    Thanks much for the guidance This is really helpfull

    I will explore more in this .

    Thanks

  • September 25, 2012 at 5:26 pm

    #1542149

    Take a look at this logon event generated by SQL 2008 Audit and then refined by LOGbinder (www.logbinder.com). Does that give you what you need? http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=24001

Viewing 4 posts - 16 through 18 (of 18 total)

You must be logged in to reply to this topic. Login to reply