西风居
===========================================================
SQL Server auditing script - 原创
===========================================================
A stored procedure + configure it to run when starting up + query it from analyzer
Create/Alter proc dbo.SecurityTrace
as
Begin
Declare @TraceIdOut int
Declare @On bit
declare @ret int
declare @status int
declare @filename nvarchar(245)

SET @On = 1
set @status = 1
set @filename = N'C:audit'+replace(convert(varchar(19),getdate(),126),':','')

exec @ret=sp_trace_create @TraceIdOut OUTPUT, 6, @filename
--select @TraceIdOut


if @ret<>0
begin
raiserror('Failed to create a trace',16,1)
end

exec sp_trace_setevent @TraceIdOut, 46, 3, @On
exec sp_trace_setevent @TraceIdOut, 46, 6, @On
exec sp_trace_setevent @TraceIdOut, 46, 7, @On
exec sp_trace_setevent @TraceIdOut, 46, 8, @On
exec sp_trace_setevent @TraceIdOut, 46, 9, @On
exec sp_trace_setevent @TraceIdOut, 46, 10, @On
exec sp_trace_setevent @TraceIdOut, 46, 11, @On
exec sp_trace_setevent @TraceIdOut, 46, 14, @On
exec sp_trace_setevent @TraceIdOut, 46, 15, @On
exec sp_trace_setevent @TraceIdOut, 46, 22, @On
exec sp_trace_setevent @TraceIdOut, 46, 26, @On
exec sp_trace_setevent @TraceIdOut, 46, 27, @On
exec sp_trace_setevent @TraceIdOut, 46, 28, @On
exec sp_trace_setevent @TraceIdOut, 46, 34, @On
exec sp_trace_setevent @TraceIdOut, 46, 35, @On
exec sp_trace_setevent @TraceIdOut, 46, 40, @On

exec sp_trace_setevent @TraceIdOut, 47, 3, @On
exec sp_trace_setevent @TraceIdOut, 47, 6, @On
exec sp_trace_setevent @TraceIdOut, 47, 7, @On
exec sp_trace_setevent @TraceIdOut, 47, 8, @On
exec sp_trace_setevent @TraceIdOut, 47, 9, @On
exec sp_trace_setevent @TraceIdOut, 47, 10, @On
exec sp_trace_setevent @TraceIdOut, 47, 11, @On
exec sp_trace_setevent @TraceIdOut, 47, 14, @On
exec sp_trace_setevent @TraceIdOut, 47, 15, @On
exec sp_trace_setevent @TraceIdOut, 47, 22, @On
exec sp_trace_setevent @TraceIdOut, 47, 26, @On
exec sp_trace_setevent @TraceIdOut, 47, 27, @On
exec sp_trace_setevent @TraceIdOut, 47, 28, @On
exec sp_trace_setevent @TraceIdOut, 47, 34, @On
exec sp_trace_setevent @TraceIdOut, 47, 35, @On
exec sp_trace_setevent @TraceIdOut, 47, 40, @On


exec sp_trace_setfilter @TraceIdOut, 34, 7, '#TEMP%'

exec sp_trace_setstatus @TraceIdOut, @status

End

exec sp_procoption N'SecurityTrace','startup','on'

exec SecurityTrace

declare @filename nvarchar(245)
set @filename='c:audit2006-04-26T102040.trc'

select DataBaseID,NTUserName,NTDomainName,HostName as ClientHostName,ClientProcessID,ApplicationName,LoginName as SQLSecurityLoginName,
StartTime,EndTime,ObjectID,ServerName,EventClass,ObjectType,ObjectName,DatabaseName,DBUserName as DatabaseUserName
from ::fn_trace_gettable(@filename, default)
whitechief 发表于:2006.04.27 02:23 ::分类: ( 计算机技术 ) ::阅读:(195次) :: 评论 (0)

发表评论
标题

在此添加评论
表情符号: smile laughing tongue angry crying sad wassat wink

称呼

邮箱地址(可选)

个人主页(可选)




切换风格
新闻聚合
博客日历
文章归档...
最新发表...
博客统计...
网站链接...