locked
SQL C2 Audit RRS feed

  • Question

  • Does anyone have a listing of all events logged by the C2 Audit?

    Tuesday, June 26, 2012 2:14 PM

Answers

  • Since C2 auditing uses a trace, you can enable C2 auditing and use sys.trace_event_bindings and the other sys.trace views to find out.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se
    • Proposed as answer by amber zhang Wednesday, June 27, 2012 1:48 AM
    • Marked as answer by amber zhang Wednesday, July 4, 2012 1:00 AM
    Tuesday, June 26, 2012 9:44 PM

All replies

  • I just turned it on and captured the output in a table.  This is what I got as the table definition (SQL Server 2008 R2 SP1)

    USE [master]
    GO
    /****** Object:  Table [dbo].[c2table]    Script Date: 06/26/2012 15:32:49 ******/
    SET ANSI_NULLS ON
    GO
    SET QUOTED_IDENTIFIER ON
    GO
    CREATE TABLE [dbo].[c2table](
    	[TextData] [ntext] NULL,
    	[BinaryData] [image] NULL,
    	[DatabaseID] [int] NULL,
    	[TransactionID] [bigint] NULL,
    	[LineNumber] [int] NULL,
    	[NTUserName] [nvarchar](256) NULL,
    	[NTDomainName] [nvarchar](256) NULL,
    	[HostName] [nvarchar](256) NULL,
    	[ClientProcessID] [int] NULL,
    	[ApplicationName] [nvarchar](256) NULL,
    	[LoginName] [nvarchar](256) NULL,
    	[SPID] [int] NULL,
    	[Duration] [bigint] NULL,
    	[StartTime] [datetime] NULL,
    	[EndTime] [datetime] NULL,
    	[Reads] [bigint] NULL,
    	[Writes] [bigint] NULL,
    	[CPU] [int] NULL,
    	[Permissions] [bigint] NULL,
    	[Severity] [int] NULL,
    	[EventSubClass] [int] NULL,
    	[ObjectID] [int] NULL,
    	[Success] [int] NULL,
    	[IndexID] [int] NULL,
    	[IntegerData] [int] NULL,
    	[ServerName] [nvarchar](256) NULL,
    	[EventClass] [int] NULL,
    	[ObjectType] [int] NULL,
    	[NestLevel] [int] NULL,
    	[State] [int] NULL,
    	[Error] [int] NULL,
    	[Mode] [int] NULL,
    	[Handle] [int] NULL,
    	[ObjectName] [nvarchar](256) NULL,
    	[DatabaseName] [nvarchar](256) NULL,
    	[FileName] [nvarchar](256) NULL,
    	[OwnerName] [nvarchar](256) NULL,
    	[RoleName] [nvarchar](256) NULL,
    	[TargetUserName] [nvarchar](256) NULL,
    	[DBUserName] [nvarchar](256) NULL,
    	[LoginSid] [image] NULL,
    	[TargetLoginName] [nvarchar](256) NULL,
    	[TargetLoginSid] [image] NULL,
    	[ColumnPermissions] [int] NULL,
    	[LinkedServerName] [nvarchar](256) NULL,
    	[ProviderName] [nvarchar](256) NULL,
    	[MethodName] [nvarchar](256) NULL,
    	[RowCounts] [bigint] NULL,
    	[RequestID] [int] NULL,
    	[XactSequence] [bigint] NULL,
    	[EventSequence] [bigint] NULL,
    	[BigintData1] [bigint] NULL,
    	[BigintData2] [bigint] NULL,
    	[GUID] [uniqueidentifier] NULL,
    	[IntegerData2] [int] NULL,
    	[ObjectID2] [bigint] NULL,
    	[Type] [int] NULL,
    	[OwnerID] [int] NULL,
    	[ParentName] [nvarchar](256) NULL,
    	[IsSystem] [int] NULL,
    	[Offset] [int] NULL,
    	[SourceDatabaseID] [int] NULL,
    	[SqlHandle] [image] NULL,
    	[SessionLoginName] [nvarchar](256) NULL,
    	[PlanHandle] [image] NULL,
    	[GroupID] [int] NULL
    ) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
    GO

    By the way, all I did was disconnect and reconnect and it made the log file 15MB!


    Thanks,

    Andrew Bainbridge
    SQL Server DBA

    Please click "Propose As Answer" if a post solves your problem, or "Vote As Helpful" if a post has been useful to you

    Tuesday, June 26, 2012 2:33 PM
  • Since C2 auditing uses a trace, you can enable C2 auditing and use sys.trace_event_bindings and the other sys.trace views to find out.


    Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se
    • Proposed as answer by amber zhang Wednesday, June 27, 2012 1:48 AM
    • Marked as answer by amber zhang Wednesday, July 4, 2012 1:00 AM
    Tuesday, June 26, 2012 9:44 PM