SQLServerCentral / Article Discussions / Article Discussions by Author / Discuss content posted by Jack Corbett / Who has accessed my 2005 server? / Latest Posts

RE: Who has accessed my 2005 server?

Jack Corbett — Tue, 09 Apr 2013 09:31:49 GMT

[quote][b]charlesd (4/9/2013)[/b][hr]I found the error and was able to get the script to run on SQL Server 2008 R2. I needed to change every occurrence of 'path' to 'T.[path]'.Thanks![/quote]Sorry about that. And to YSLGuru, I only updated that part.

RE: Who has accessed my 2005 server?

charlesd — Tue, 09 Apr 2013 09:13:09 GMT

I found the error and was able to get the script to run on SQL Server 2008 R2. I needed to change every occurrence of 'path' to 'T.[path]'.Thanks!

RE: Who has accessed my 2005 server?

YSLGuru — Tue, 09 Apr 2013 09:07:47 GMT

[quote][b] Jack Corbett (4/9/2013)[/b][hr][quote][b]charlesd (4/2/2013)[/b][hr]The script is very useful. I know it was designed for SQL 2005, however it also seems to work on SQL 2008. I have tried it on several SQL 2008 servers successfully, but I am getting an error on one of them and I'm not sure exactly why. SQL Server would be running on a Windows 2008 R2 Virtual Server. Here is the error:Server: Msg 567, Level 16, State 7, Line 1File 'S:\Microsoft SQL Server\MSSQL.1\MSSQL\Data\MSSQL10.trc' either does not exist or is not a recognizable trace file. Or there was an error opening the file.This is definitely a valid file on the server. I am able to open it directly with SQL Profiler, but not using the script from a query window in SSMS.Thanks![/quote]Charles,Sorry for the delayed reply. This version of the script actually doesn't work on 2008 R2 because MS changed the path to the trace file a bit so the CASE that creates the path doesn't work correctly. Here's what you need to change for R2:[code="sql"]sys.fn_trace_gettable(CASE WHEN PATINDEX('%Log[_]%', path)<> 0 THEN LEFT(path, PATINDEX('%Log[_]%', path) + 2) + '.trc' ELSE T.[path] END, T.max_files)[/code][/quote]jackDid you update the actual script as well for R2 or did you just make the changes in the posting?

RE: Who has accessed my 2005 server?

charlesd — Tue, 09 Apr 2013 08:45:13 GMT

Thanks for those suggestions, but I am getting a syntax error when I try to run them. Could you please send me the entire script with the change.Thanks

RE: Who has accessed my 2005 server?

Jack Corbett — Tue, 09 Apr 2013 07:41:00 GMT

[quote][b]marie contencin (4/4/2013)[/b][hr]Hi,I do not like "NULL" value in results.May I suggest this :...CASE when S.type_desc is NULL then 'allowed via a Windows Group' else S.type_desc end as type_desc,...:-)[/quote]Marie,That's a nice little add, if you don't like the NULL's.

RE: Who has accessed my 2005 server?

Jack Corbett — Tue, 09 Apr 2013 07:40:18 GMT

[quote][b]charlesd (4/2/2013)[/b][hr]The script is very useful. I know it was designed for SQL 2005, however it also seems to work on SQL 2008. I have tried it on several SQL 2008 servers successfully, but I am getting an error on one of them and I'm not sure exactly why. SQL Server would be running on a Windows 2008 R2 Virtual Server. Here is the error:Server: Msg 567, Level 16, State 7, Line 1File 'S:\Microsoft SQL Server\MSSQL.1\MSSQL\Data\MSSQL10.trc' either does not exist or is not a recognizable trace file. Or there was an error opening the file.This is definitely a valid file on the server. I am able to open it directly with SQL Profiler, but not using the script from a query window in SSMS.Thanks![/quote]Charles,Sorry for the delayed reply. This version of the script actually doesn't work on 2008 R2 because MS changed the path to the trace file a bit so the CASE that creates the path doesn't work correctly. Here's what you need to change for R2:[code="sql"]sys.fn_trace_gettable(CASE WHEN PATINDEX('%Log[_]%', path)<> 0 THEN LEFT(path, PATINDEX('%Log[_]%', path) + 2) + '.trc' ELSE T.[path] END, T.max_files)[/code]

RE: Who has accessed my 2005 server?

marie contencin — Thu, 04 Apr 2013 03:56:54 GMT

Hi,I do not like "NULL" value in results.May I suggest this :...CASE when S.type_desc is NULL then 'allowed via a Windows Group' else S.type_desc end as type_desc,...:-)

RE: Who has accessed my 2005 server?

charlesd — Tue, 02 Apr 2013 08:27:23 GMT

The script is very useful. I know it was designed for SQL 2005, however it also seems to work on SQL 2008. I have tried it on several SQL 2008 servers successfully, but I am getting an error on one of them and I'm not sure exactly why. SQL Server would be running on a Windows 2008 R2 Virtual Server. Here is the error:Server: Msg 567, Level 16, State 7, Line 1File 'S:\Microsoft SQL Server\MSSQL.1\MSSQL\Data\MSSQL10.trc' either does not exist or is not a recognizable trace file. Or there was an error opening the file.This is definitely a valid file on the server. I am able to open it directly with SQL Profiler, but not using the script from a query window in SSMS.Thanks!

RE: Who has accessed my 2005 server?

YSLGuru — Wed, 20 Jan 2010 12:03:15 GMT

[quote][b]Jack Corbett (12/22/2009)[/b][hr]If you are using the current version of the script you should be getting data from ALL the trace files. The T.path column will only return the path of the current file which is why there is a CASE statement setting up the first parameter in the call to fn_trace_gettable. T.path comes form the sys.traces table so it only has the current file name.[/quote]"yeaaaahhhhhh, I'm gonna need you to come in this wekedn, yeahhhh, both Saturday & sunday, uhh,huuu"Right now I am figuratively banging my head and yelling "Idiot!" at myself. Thanks. SOmetims its hard to see the data for the rows & columns

RE: Who has accessed my 2005 server?

Jack Corbett — Tue, 22 Dec 2009 17:50:53 GMT

If you are using the current version of the script you should be getting data from ALL the trace files. The T.path column will only return the path of the current file which is why there is a CASE statement setting up the first parameter in the call to fn_trace_gettable. T.path comes form the sys.traces table so it only has the current file name.

RE: Who has accessed my 2005 server?

YSLGuru — Mon, 21 Dec 2009 17:17:33 GMT

Jack,I just re-discovered this script, something I used a while back and I've hit an odd snag. Last time I see I posted that when i ran it I only got info from the last/most recent trc file. I just troed thsi again and darned if I'm not still having the same issue. I did check and the DB COmpatability for my MASTER DB is 2005 and I am using a 2005 server and yet the value of T.Path is the same for all rows retruned and that is the last trc file created. I checked and there are 5 trc files and 2 of those have todays date so I'm trying to figure out why I'm still getting just the last one.Any thoiughts?I'm gonna use this for some Login auditing checkjs because it looks like this is the only way in SQL 2005 to find out login auditing data. I can't believe that by 2005 the SQL Server product didn;t have some decent auditing abilities yet.Thanks

RE: Who has accessed my 2005 server?

Jack Corbett — Tue, 07 Jul 2009 21:13:35 GMT

Eswin,There is not a similar script for 2000 because 2000 does not have the default trace. You can create a trace in 2000 that mimics the 2005 Default Trace and then you could create a similar script that reads that trace file(s). You would need to put the Trace creation in a stored procedure and then have that sp run at startup.

RE: Who has accessed my 2005 server?

Eswin — Tue, 07 Jul 2009 20:32:02 GMT

HiIs there any similar script that can be used in SQl server 2000.

RE: Who has accessed my 2005 server?

Atif-ullah Sheikh — Thu, 30 Apr 2009 03:59:00 GMT

Very Useful script. Thanks...

RE: Who has accessed my 2005 server?

Jack Corbett — Wed, 22 Apr 2009 06:03:56 GMT

krombit,I have seen this error. I get this error when I run the script in a database where the compatibility level is set to something other than SQL Server 2005. So check the compatibility level of the db you are running the query in or run the query in tempdb.

RE: Who has accessed my 2005 server?

krombit — Tue, 21 Apr 2009 23:27:08 GMT

Didn't work for me. The following error when attempting to run this on 9.0.3159 in a clustered environment.Msg 156, Level 15, State 1, Line 14Incorrect syntax near the keyword 'CASE'.

RE: Who has accessed my 2005 server?

Jack Corbett — Tue, 14 Apr 2009 02:28:42 GMT

The "new" code with the file number removed should load all the files for the specified trace. On my laptop, which I reboot somewhat regularly, and does not have a really active SQL Server, the code without removing the file number only queries the "active" file while the new code returns data from all the files.

RE: Who has accessed my 2005 server?

YSLGuru — Mon, 13 Apr 2009 15:53:23 GMT

[quote][b]Jack Corbett (2/9/2009)[/b][hr]I modified the code in the script to fix this oversight. Steve just needs to release the updated code. Here it is here as well:[code]SELECT I.NTUserName, ..... {Removed for brevity} ... I.LoginSid is not nullGroup By I.NTUserName, I.loginname, I.SessionLoginName, I.databasename, S.principal_id, S.sid, S.type_desc, S.name[/code]I overlooked the fact that the Path stored in sys.traces includes the numeric extension to the file name. The CASE strips the numeric portion of the file name.[/quote]Apolagies if this sounds dumb because I may just be missing something but the way I read your reply with this new code was that it would load all of the traace files and not just the last one else why strip out the file number portion of the trace file name? When I run this exact code as is I only get data from the most recent trace file.Whats weird about this is I swear there was a forum posting discussing this same thing with the fn_Trace_Gettable() function/procedure and I thought someone did list a way to get the thing to load content from all trc files in that same directory. Am I going crazy or is that familiar to anyone else, that there is a way to load all the trc file?Thanks Jack!

RE: Who has accessed my 2005 server?

Manie Verster — Fri, 10 Apr 2009 06:31:04 GMT

Thanks Jack, this is real nice and I have already added it to my collection of scripts. I look forward to that articles about the Profiler!

RE: Who has accessed my 2005 server?

Jack Corbett — Thu, 09 Apr 2009 10:10:54 GMT

Thanks Manie.You can use the default trace to check for login failures, here's an idea on how:[code]SELECT I.*FROM sys.traces T CROSS Apply :: fn_trace_gettable(CASE WHEN CHARINDEX('_', T.[path]) <> 0 THEN SUBSTRING(T.PATH, 1, CHARINDEX('_', T.[path]) - 1) + '.trc' ELSE T.[path] End, T.max_files) I JOIN sys.trace_events AS TE ON I.EventClass = TE.trace_event_id WHERE TE.[name] = 'Audit Login Failed' [/code]At R. Barry Young's suggestion I am working on a presentation about mining the default trace that will likely turn into at least one article here at SSC within a year or so. Your question helps with ideas. It takes me awhile to write and I have a series on Profiler that I need to finish first.

RE: Who has accessed my 2005 server?

Manie Verster — Thu, 09 Apr 2009 07:02:43 GMT

Great script Jack! Thanks for this and I know its been out for a while already but I have been real busy. This will help me a lot. I will definitely implement it. I would also like to get a list of login failures so I can follow it up because someone one day told me that if you have a lot of login failures it may be someone trying to hack the database. Be glad if you could help me!

RE: Who has accessed my 2005 server?

Jack Corbett — Mon, 09 Feb 2009 19:40:26 GMT

I modified the code in the script to fix this oversight. Steve just needs to release the updated code. Here it is here as well:[code]SELECT I.NTUserName, I.loginname, I.SessionLoginName, I.databasename, Min(I.StartTime) as first_used, Max(I.StartTime) as last_used, S.principal_id, S.sid, S.type_desc, S.nameFROM sys.traces T CROSS Apply ::fn_trace_gettable(CASE WHEN CHARINDEX( '_',T.[path]) <> 0 THEN SUBSTRING(T.PATH, 1, CHARINDEX( '_',T.[path])-1) + '.trc' ELSE T.[path] End, T.max_files) I LEFT JOIN sys.server_principals S ON CONVERT(VARBINARY(MAX), I.loginsid) = S.sid WHERE T.id = 1 And I.LoginSid is not nullGroup By I.NTUserName, I.loginname, I.SessionLoginName, I.databasename, S.principal_id, S.sid, S.type_desc, S.name[/code]I overlooked the fact that the Path stored in sys.traces includes the numeric extension to the file name. The CASE strips the numeric portion of the file name.

RE: Who has accessed my 2005 server?

Jack Corbett — Mon, 09 Feb 2009 19:18:33 GMT

[quote][b]Vitali Lisau (2/9/2009)[/b][hr]The code is nice, but it actually shows only the records from the last trace file (SQL Srv 2005 Ent , SP2 and SP3).select * from sys.traces - returns the last trace file, e.g 'E:\MSSQL\SystemData\MSSQL.1\MSSQL\LOG\log_734.trc'But ::fn_trace_gettable() - requires the first file name from the sequence.For example, if there are 5 files stored, then it is necessary to pass('E:\MSSQL\SystemData\MSSQL.1\MSSQL\LOG\log_730.trc', 5)Otherwise, you will see info only from the last file. I also tried going back by passing the last file name and negative number of files(-3), but it did not work as desired - only the last log info was returned.[/quote]You are correct that is a nice catch. This actual happens because Path actually includes the file number instead of the default name. I will correct the code to reflect this.

RE: Who has accessed my 2005 server?

david.sturm — Mon, 09 Feb 2009 17:00:27 GMT

when I run the script( as posted), error is returned:Msg 102, Level 15, State 1, Line 14Incorrect syntax near 'T'.this: select * from sys.tracesreturns: C:\Program Files\Microsoft SQL Server\MSSQL\log\log_77.trcI am a novice at Traces and profiler.what might be my error?

RE: Who has accessed my 2005 server?

Vitali Lisau — Mon, 09 Feb 2009 16:42:29 GMT

The code is nice, but it actually shows only the records from the last trace file (SQL Srv 2005 Ent , SP2 and SP3).select * from sys.traces - returns the last trace file, e.g 'E:\MSSQL\SystemData\MSSQL.1\MSSQL\LOG\log_734.trc'But ::fn_trace_gettable() - requires the first file name from the sequence.For example, if there are 5 files stored, then it is necessary to pass('E:\MSSQL\SystemData\MSSQL.1\MSSQL\LOG\log_730.trc', 5)Otherwise, you will see info only from the last file. I also tried going back by passing the last file name and negative number of files(-3), but it did not work as desired - only the last log info was returned.

RE: Who has accessed my 2005 server?

Jack Corbett — Mon, 10 Nov 2008 11:02:15 GMT

Yes, within reason. It does not demonstrate how to start the trace when SQL Server starts.

RE: Who has accessed my 2005 server?

YSLGuru — Mon, 10 Nov 2008 10:44:08 GMT

Jack -Thanks for the inf. So the video you are referencing, it can show one how to basically create your own custom server side trace to do what the default one in 2005 does but do it capturing what you;ve specified in your custom trace? I imagine based on your descrpition that the video will show you how to take a trace you've defined (like a termplate trace you've created) and apply that as the server side trace.Thanks

RE: Who has accessed my 2005 server?

Jack Corbett — Mon, 10 Nov 2008 10:16:05 GMT

SQL Server 2005 has a basic trace that is created when you install SQL Server and starts on start-up. You could remove this trace if you wanted to, but since you didn't know about it, it obviously isn't negatively affecting performance. This is also what many of the Management reports get their data from.Profiler is actually just a GUI interface on top of server-side tracing. You could check out the Profiler video's on [url]www.jumpstarttv.com[/url] where I explain how to use Profiler to generate a script for a server-side trace.You can also lookup server-side trace in BOL.

RE: Who has accessed my 2005 server?

YSLGuru — Mon, 10 Nov 2008 10:02:01 GMT

This probably sounds like a no-brainer but I have a question about the code. I understand what it does but what I didn't know about is the trace itself. Does SQL Server by default always run a trace on every connection and that's what this code is returning the details on? IO thought traces were restricted to Profiler. If the answer is yes then is this default trace similar to a trace in Profiler?Thanks

RE: Who has accessed my 2005 server?

Jane Matheson-154829 — Wed, 05 Nov 2008 06:08:18 GMT

Really useful script that shows how to do use the trace. Thanks!

Who has accessed my 2005 server?

Jack Corbett — Sat, 20 Sep 2008 04:26:45 GMT

Comments posted to this topic are about the item [B]Who has accessed my 2005 server?[/B]