===========================================================
SQL Server auditing script - 原创
===========================================================
作者: whitechief(http://whitechief.itpub.net)
发表于: 2006.04.27 02:23
分类: 计算机技术
出处: http://whitechief.itpub.net/post/1825/75804
---------------------------------------------------------------
发表于: 2006.04.27 02:23
分类: 计算机技术
出处: http://whitechief.itpub.net/post/1825/75804
---------------------------------------------------------------
A stored procedure + configure it to run when starting up + query it from analyzer
Create/Alter proc dbo.SecurityTrace
as
Begin
Declare @TraceIdOut int
Declare @On bit
declare @ret int
declare @status int
declare @filename nvarchar(245)
SET @On = 1
set @status = 1
set @filename = N'C:audit'+replace(convert(varchar(19),getdate(),126),':','')
exec @ret=sp_trace_create @TraceIdOut OUTPUT, 6, @filename
--select @TraceIdOut
if @ret<>0
begin
raiserror('Failed to create a trace',16,1)
end
exec sp_trace_setevent @TraceIdOut, 46, 3, @On
exec sp_trace_setevent @TraceIdOut, 46, 6, @On
exec sp_trace_setevent @TraceIdOut, 46, 7, @On
exec sp_trace_setevent @TraceIdOut, 46, 8, @On
exec sp_trace_setevent @TraceIdOut, 46, 9, @On
exec sp_trace_setevent @TraceIdOut, 46, 10, @On
exec sp_trace_setevent @TraceIdOut, 46, 11, @On
exec sp_trace_setevent @TraceIdOut, 46, 14, @On
exec sp_trace_setevent @TraceIdOut, 46, 15, @On
exec sp_trace_setevent @TraceIdOut, 46, 22, @On
exec sp_trace_setevent @TraceIdOut, 46, 26, @On
exec sp_trace_setevent @TraceIdOut, 46, 27, @On
exec sp_trace_setevent @TraceIdOut, 46, 28, @On
exec sp_trace_setevent @TraceIdOut, 46, 34, @On
exec sp_trace_setevent @TraceIdOut, 46, 35, @On
exec sp_trace_setevent @TraceIdOut, 46, 40, @On
exec sp_trace_setevent @TraceIdOut, 47, 3, @On
exec sp_trace_setevent @TraceIdOut, 47, 6, @On
exec sp_trace_setevent @TraceIdOut, 47, 7, @On
exec sp_trace_setevent @TraceIdOut, 47, 8, @On
exec sp_trace_setevent @TraceIdOut, 47, 9, @On
exec sp_trace_setevent @TraceIdOut, 47, 10, @On
exec sp_trace_setevent @TraceIdOut, 47, 11, @On
exec sp_trace_setevent @TraceIdOut, 47, 14, @On
exec sp_trace_setevent @TraceIdOut, 47, 15, @On
exec sp_trace_setevent @TraceIdOut, 47, 22, @On
exec sp_trace_setevent @TraceIdOut, 47, 26, @On
exec sp_trace_setevent @TraceIdOut, 47, 27, @On
exec sp_trace_setevent @TraceIdOut, 47, 28, @On
exec sp_trace_setevent @TraceIdOut, 47, 34, @On
exec sp_trace_setevent @TraceIdOut, 47, 35, @On
exec sp_trace_setevent @TraceIdOut, 47, 40, @On
exec sp_trace_setfilter @TraceIdOut, 34, 7, '#TEMP%'
exec sp_trace_setstatus @TraceIdOut, @status
End
exec sp_procoption N'SecurityTrace','startup','on'
exec SecurityTrace
declare @filename nvarchar(245)
set @filename='c:audit2006-04-26T102040.trc'
select DataBaseID,NTUserName,NTDomainName,HostName as ClientHostName,ClientProcessID,ApplicationName,LoginName as SQLSecurityLoginName,
StartTime,EndTime,ObjectID,ServerName,EventClass,ObjectType,ObjectName,DatabaseName,DBUserName as DatabaseUserName
from ::fn_trace_gettable(@filename, default)
Create/Alter proc dbo.SecurityTrace
as
Begin
Declare @TraceIdOut int
Declare @On bit
declare @ret int
declare @status int
declare @filename nvarchar(245)
SET @On = 1
set @status = 1
set @filename = N'C:audit'+replace(convert(varchar(19),getdate(),126),':','')
exec @ret=sp_trace_create @TraceIdOut OUTPUT, 6, @filename
--select @TraceIdOut
if @ret<>0
begin
raiserror('Failed to create a trace',16,1)
end
exec sp_trace_setevent @TraceIdOut, 46, 3, @On
exec sp_trace_setevent @TraceIdOut, 46, 6, @On
exec sp_trace_setevent @TraceIdOut, 46, 7, @On
exec sp_trace_setevent @TraceIdOut, 46, 8, @On
exec sp_trace_setevent @TraceIdOut, 46, 9, @On
exec sp_trace_setevent @TraceIdOut, 46, 10, @On
exec sp_trace_setevent @TraceIdOut, 46, 11, @On
exec sp_trace_setevent @TraceIdOut, 46, 14, @On
exec sp_trace_setevent @TraceIdOut, 46, 15, @On
exec sp_trace_setevent @TraceIdOut, 46, 22, @On
exec sp_trace_setevent @TraceIdOut, 46, 26, @On
exec sp_trace_setevent @TraceIdOut, 46, 27, @On
exec sp_trace_setevent @TraceIdOut, 46, 28, @On
exec sp_trace_setevent @TraceIdOut, 46, 34, @On
exec sp_trace_setevent @TraceIdOut, 46, 35, @On
exec sp_trace_setevent @TraceIdOut, 46, 40, @On
exec sp_trace_setevent @TraceIdOut, 47, 3, @On
exec sp_trace_setevent @TraceIdOut, 47, 6, @On
exec sp_trace_setevent @TraceIdOut, 47, 7, @On
exec sp_trace_setevent @TraceIdOut, 47, 8, @On
exec sp_trace_setevent @TraceIdOut, 47, 9, @On
exec sp_trace_setevent @TraceIdOut, 47, 10, @On
exec sp_trace_setevent @TraceIdOut, 47, 11, @On
exec sp_trace_setevent @TraceIdOut, 47, 14, @On
exec sp_trace_setevent @TraceIdOut, 47, 15, @On
exec sp_trace_setevent @TraceIdOut, 47, 22, @On
exec sp_trace_setevent @TraceIdOut, 47, 26, @On
exec sp_trace_setevent @TraceIdOut, 47, 27, @On
exec sp_trace_setevent @TraceIdOut, 47, 28, @On
exec sp_trace_setevent @TraceIdOut, 47, 34, @On
exec sp_trace_setevent @TraceIdOut, 47, 35, @On
exec sp_trace_setevent @TraceIdOut, 47, 40, @On
exec sp_trace_setfilter @TraceIdOut, 34, 7, '#TEMP%'
exec sp_trace_setstatus @TraceIdOut, @status
End
exec sp_procoption N'SecurityTrace','startup','on'
exec SecurityTrace
declare @filename nvarchar(245)
set @filename='c:audit2006-04-26T102040.trc'
select DataBaseID,NTUserName,NTDomainName,HostName as ClientHostName,ClientProcessID,ApplicationName,LoginName as SQLSecurityLoginName,
StartTime,EndTime,ObjectID,ServerName,EventClass,ObjectType,ObjectName,DatabaseName,DBUserName as DatabaseUserName
from ::fn_trace_gettable(@filename, default)











