Home Forums SQL Server 2012 SQL 2012 - General Addressing parameterized queries in SQL SERVER DATABASE AUDIT for HIPAA / SOX / PCI ? RE: Addressing parameterized queries in SQL SERVER DATABASE AUDIT for HIPAA / SOX / PCI ?

  • To my knowledge SQL Audit will capture ad hoc queries, parameterized queries and stored procedures. It just doesn't keep the values that are passed to parameters. This is the same for stored procedures, not just parameterized queries. If you want to capture every single value passed, you can just use Extended Events to capture the queries made to the system. You'll have to be prepared to manage quite a lot of data, but it's easy enough to capture all everything if that's what you want. You could also look to enable Change Data Capture in addition to SQL Audit if you really want to see each and every change.

    The audits I've had done in the past didn't require us to capture all values passed to the database.

    "The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
    - Theodore Roosevelt

    Author of:
    SQL Server Execution Plans
    SQL Server Query Performance Tuning