locked
Logon events RRS feed

  • Question

  • Hello!

    When auditing logon events in my SQL Server (SUCCESSFULL/FAILED LOGON EVENTS audit specification) I see 7 events with the ~ same event_time values (for example, 14:45:16.1427822 - 14:45:16.141740374) for each logon - is it normal?


    I mean if I connect to the server as Domain\User1 there will be 7 exactly the same raws for that user with the logon times (event_time) that differ only in milliseconds.

    select * FROM sys.fn_get_audit_file ('C:\AUDIT\*',default,default)

    Thank you in advance,
    Michael

    Wednesday, September 11, 2019 8:34 AM

Answers

  • Hello!

    When auditing logon events in my SQL Server (SUCCESSFULL/FAILED LOGON EVENTS audit specification) I see 7 events with the ~ same event_time values (for example, 14:45:16.1427822 - 14:45:16.141740374) for each logon - is it normal?


    I mean if I connect to the server as Domain\User1 there will be 7 exactly the same raws for that user with the logon times (event_time) that differ only in milliseconds.


    Yes the user executed multiple queries with same login. Please see few of them have different session_id. There is also possibility of MARS where more than one process is getting executed on single connection.

    Cheers,

    Shashank

    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

    My TechNet Wiki Articles

    MVP

    • Marked as answer by MF47 Wednesday, September 11, 2019 9:24 AM
    Wednesday, September 11, 2019 9:23 AM

All replies

  • Hello!

    When auditing logon events in my SQL Server (SUCCESSFULL/FAILED LOGON EVENTS audit specification) I see 7 events with the ~ same event_time values (for example, 14:45:16.1427822 - 14:45:16.141740374) for each logon - is it normal?


    I mean if I connect to the server as Domain\User1 there will be 7 exactly the same raws for that user with the logon times (event_time) that differ only in milliseconds.


    Yes the user executed multiple queries with same login. Please see few of them have different session_id. There is also possibility of MARS where more than one process is getting executed on single connection.

    Cheers,

    Shashank

    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

    My TechNet Wiki Articles

    MVP

    • Marked as answer by MF47 Wednesday, September 11, 2019 9:24 AM
    Wednesday, September 11, 2019 9:23 AM
  • Thank you for the help, Shanky_621!

    Regards,
    Michael

    Wednesday, September 11, 2019 9:25 AM