This is my first question here for a long while, so be extra nice ;)
I am doing an audit on some of my sql server 2000s and I would to know if its possible to automate the collection of some of the data.
Firstly I would like to be able to query the domain account that SQLSERVER and SQLAGENT are running on, in my case the agent and service account will alaways be the same, but the account name maybe different depending on what server it is.
Secondly I would like to be able to query whether the account SQL server is running on is local admin of the server...I know some of you will say the SQL account has to be local admin but with the right registry and folder level permissions it is not necessary for the account to be local admin. This was a requirement from a very strict security audit.
I have made a server security audit and specify from database audit specification to audit "select" on a certain user and on a certain table. I logged in by this user and made the select statement..when i run this query
"select * from sys.fn_get_audit_file('d:Auditaudit1*',null,null)"
It return a value at which time the query has done
after 15 minutes i repeated the same action, i run the audit query and the same result is showed off on the panel.is it suppose to return a list of values by how many times this user has made the select statement on that table ? for example at 5:00 pm then 6:00 pm and so on
Good morning, Im having a little problem with this report I need to generate, so I thought I would ask for some advice. I have 2 tables. The 1st is the actual table and the 2nd is the log table (Employee; Employee_log). the '_log' table is an image of the Employee table except it has 4 extra fields (recID, last_updated_employee_id, operation and operation_date) recid being the PK of the log table. I need to generate a report that contains some thing like the following:
Table_Name
Column_Name
Old_Value
New_Value
Employee_Modifier
Operation
Operation_Date
Employee
LastName
Reid
Blevins
Jessica Bluff
UPDATE
2/2/2008
Employee
FirstName
Bison
Blison
Jessica Bluff
UPDATE
2/1/2008
Employee
EmployeeID
1234
Jessica Bluff
INSERT
2/1/2008
Employee
EmployeeID
75
Bill Thompson
DELETE
1/28/2008
To do this, I compare the Employee table to the Employee_log table. If I find changes (the two columns do not equal), I add that columnName and the column value for the regular table(new_value) and the column value for the log table(old value). If anyone has a solution or some sql to help me out, it would be greatly appreciated. (A query that will give me each columnName with the value per row would help; Somehow possibly joining my Employee table with 'INFORMATION_SCHEMA.COLUMNS' ??) Thanks!
I need help...here is the problem.Last weekend, the servers in our datacenter where moved around. After thismove, and maybe coincidental, 1 server is performing very poor. Afterrunning a trace with SQL Profiler, I saw the problem which was laterconfirmed with another tool for SQL server performance monitoring. It seemsthat all connections to the SQL server (between 200 - 400) are doing a login/ logout for each command that they process. For example, the user'sconnection will login, perform a SELECT, and then logout. This is not a..NET application. The client software was not changed, it is still thesame. The vendor has said that it is not supposed to do that, it issupposed to use 1 connection that log's on in the morning and logs off atthe end of the day or whenever the user exits. 1 user may have severalconnections to the database.At times, the server is processing over 250 login / logouts (avgeraged for30 second period). Has anyone seen this problem? I have the server inAUDIT FAILUREs only. The server has become very unresponsive, things thattook 3 seconds now take over 15 seconds.Any ideas???
I have setup a Database Audit Specification as follows:
Audit Action Type: SELECT | Object Class: DATABASE | Object Name: SHOPDB | Principal Name: public
Now, when I perform a SELECT query with a bound parameter such as:
SELECT * FROM myTable WHERE name='queryname'
What I see through the Audit Logs is something like:
SELECT * FROM myTable WHERE name='@1'
I understand that it is by design that we cannot see these parameters throught Database Level Auditing. I would like to know whether it is possible to see these parameters by any other means using
(1) SQL Server Enterprise Edition, (2) SQL Server Standard Edition, or (3) by an external tool.
I want to register into a table each time a user creates, modifies or deletes any object in a database. It's not possible to add a trigger to the sysobjects table. What can I do?
I enabled the C2 Audit option for my SQL server and it is working allright. i am trying to figure out how can i configure the audit to run for specific databases/tables only. I have several databases on the server but I just want to audit one table in one database for PCI compliance rules. Any recommendations?
I wish to track changes made to a table, including login who made the change, time of change, etc, without having to change the existing table structure, stored procedures, application. If anyone has any strategies (with a brief explanation) or articles they could point me to, it would be very much appreciated.
My thinking is to set up a trigger to write both old and new data to a audit table but considering different strategies may be helpful.
I have tried to make my basic audit log do more, but i haven't gotten very far;
In my basic audit log, i record this information:
table type of change field modified old value new value db user date/time
This audit records everything, which is great, but it cannot relate information when i go back to analyze the changes; for example, when a "directory" record is added, a user's information may be entered into several different tables, such as:
name (different table) addresses (different table) phone numbers (different table)
If one wanted to look up the changes to addresses of a person in the directory based on the person's name, i could not do it with my existing audit log because the addresses would be in a different table than the name table and there is no relating data in the audit log to relate the address changes to a persons name;
What might be a solution? I have tried a few approaches and am at a loss;
does anyone know how i can audit a servers login id's and tell the last time it was used. i have just gain about 8 sql servers with a bunch of users that i know are no longer around. so i am trying to trim out dead id's
I am currently developing a system which uses SQL Server 7 as its repositry. One of the systems requirements is the ability to be able to record any changes made to the data, and by whom. In other words I need to store the before and after with a userid.
Is there away to track which user had deleted and object(table), the transaction log has that information but you can't read it and the error log doesn't log such info. Any advice would be appricated, thanks.
Have a scenario where we have to audit all our databases and servers for changes in security accross the servers.
We have a central montioring server where we pull SQL metadata at regular intervals. In this instance we are looking to have before and after snapshots of the SQL system tables.
For the logins this is fine as there is a last updated field in the syslogins table. We can tell when a new user has been added , remmoved or the login has changed ie the login as been added to sysadmin fixed server role... etc Perfect !!!
What Im trying to work out now is how I can do this for object level permsisions. Have looked at sysprotects but no joy. If a user or a role has been granted select or update on a table... How can I tell based on before and after snap shots of the system tables what permissons have changed and whom have they changed for...
Hi all, I would just like to ask whats the best way to make some audit on some of the tables in a MS SQL server, what i'm planning to have is to have a table which can contain all changes/inserts/deletion of some given tables, my first idea was to have this:
AuditTable that have the following fields: AuditID, TableName, FieldName, OldValue, NewValue, UpdateBy, UpdateDate
then in all the given tables, i'll have insert, update and delete trigger, the issue comes down to the trigger, what will be the best way to have that trigger written in a way that it can be use for other tables as well? say if a table have more then 20 fields, I don't want to declare 20 var and compare them 1 by1, and if there is a diff, then i insert to the audittable, I want something that it can loop and (if possible) be able to use by other table as well, so the field name etc can get from sysobjects, but then how can you code it in a way that it can do that?
Or is there any better way to get the same result? currently i have an audit table for each table i want to audit on and its just wasting space, any help will be great. Thanks,
Does MSSQL 2000 and above have an auditing feature? We have a requirement for tracking activity and history on a particular table. I realize this can be accomplished by a simple trigger but I was wondering if MSSQL had a feature that would accomplish this.
I turned the Audit ALL option on SQLServer instance "security" tab and restarted the SQLServer but do not see any information logged in SQLServer Logs though I tried to access databases and logged in a couple of times through Query Analyzer. Why is that no logging happened and how can I get this fixed?
Hi, AllI use SQL Server 2000 and Win 2003 Server. I try to create a SQL ServerLogin audit log using Profiler, but cannot find the tools. I looked at theWindows Event Viewer, it only logs Windows authentications users for SQLServer not SQL Server users (Mixed mode users).Please help on creating SQL Server Login log (username,password and time).ThanksKai
Hi...A much lamented question, I guess..I'm trying to create a simple audit trail.log the changes to an SQL 2000 table, so that they are written into amirror table. The entire record, only the updated one, i.e. if sayonly one field changes, the audit table will be inserted with onerecord that has one field changed. if the record has been deleted, itstill will be written.I'm not worrying about additional fields to the audit table containingdescriptive flags of what action took place yet. I just want themirror image for starters.I got the script of the 'create table' off Query analyzer. created theaudit table.the trigger looks like this:CREATE TRIGGER dt_tbl1_auditon tbl1for insert, update, deleteASinsert into tbl1_auditselect * from insertedthe table has about 50 fields or so, so I tried to make do with *'s.didn't work, so I tried copying and pasting the explicit list of fieldnamesinstead (though I'm not sure why it needs that if the two tables areidentically structured).in either case, if I update any field on the audited table, I get thiserror:(after getting the warning that the results may take a long time toprocess etc, the original table has over 100,000 rows)"another user has modified the contents of this table or view,the database row you are modifying no longer exists in the databasedatabase error: insert error:column name or number of supplied values does not match tabledefinition"I'm not sure what's wrong, the two tables are identical (I copy pastedthe create table script with no changes). no other users except me onthis database.i've removed all constraints and indexes from the audit table.thanks
I wont to get text of statement which chaged actual table.
with this script :
Code Block if object_id('dbo.mytable') is not null drop table dbo.mytable go create table dbo.mytable (f1 varchar(100)) go alter trigger dbo.ti_mytable on dbo.mytable for insert as set nocount on print 'in trigger' DECLARE @sql_handle binary(20) select @sql_handle = sql_handle FROM master.dbo.sysprocesses p (nolock) where spid = @@spid select @sql_handle, @@spid, [text] FROM ::fn_get_sql(@sql_handle) as statement_text GO
if I execute
Code Block insert into mytable values ('test')
I getting text of the trigger. How I can get @sql_handle of original statement ?
I need to track all changes to my database at the application level. Say if anybody logs into the application with his user id and password, any add,delete,update should be tracked. This is an application with 5000 transactions a day. I thought of using a trigger on all the tables to capture the following fields.
[UserID]
[AuditDate]
[TableName]
[PrimaryKey]
[Action]
,PreviousValue]
[CurrentValue]
I thought of adding all the application user as a database user. So then userID will be SYSTEM_USER , and AuditDate will be GETDATE(). Is this a good idea?
I dono whether the field primarykey is really essential in my audit table? Please advice.
The field 'Action' will be update/delete/insert. Previous and Current value will be the entire record from the temp tables inserted and deleted in triggers. I dono whether this is a good idea to store the entire record or just the field which was changed or updated(as updates r gonna be more than insert and delete), and the entire record for insert and delete. Is that possible? We have columns_updated() in sql server 2005 where we can we find the columns which was updated. Will that work?
Can i capture all actions(inser/update/delete) in a trigger with FOR INSERT,UPDATE,DELETE ? If so, how can i update "ACTION" and implement something different for update(as discussed earlier) . Is there any other field which you think i should capture which might be important as a part of auditing or tracking.
Can we use trigger for all tables in the database at one time?
I know there are too many questions . I wud greatly appreciate any thoughts or help for any portion of it.
I'm running a SQL 2005 enterprise edition and we are looking at using C2 audit. Does anybody have any experience with this? Things to think of? Do's and don'ts? I haven't found much documention on this at Mircosoft.
I have been given the advice to log the audit onto another server (and not to the server where the audit is running), I'm not sure how to do this though. Are there settings for C2? I thought the "on and off button" was all.
It is important to have enough space for the log files since SQL server shuts down if it runs out of space. Difficult to know how much space is needed though.
We are currently porting our POINT OF SALE system to SQL Server 2005. In our existing software we log database changes (inserts, amendments and deletions) to a flat acsii files so that these files can be FTP'd to remote sites (largest number of sites 100+) and processed on to replicate the data.
I have looked at REPLICATION in MSSQL 2005 but we need two way replication and additional processing. Therefore I dont think we will be able to use this feature.
Therefore what I wanted to do was to try and setup an automated way of capturing database changes to all tables within the database and log these changes to XML to be shipped out to remote sites. Unfortunatly I can only find TABLE TRIGGERS which would require creating 100's of triggers as we have 100's of tables.
Is there anyway of setting up MSSQL server to automatically do something like this... I was looking to see if there was a DATABASE TRIGGER which could perform this action but I cant see anything...
Can anyone advise or is there a simpler way of doing this ??
