Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

Trace login created or dropped event Expand / Collapse
Author
Message
Posted Monday, November 19, 2012 3:54 PM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Monday, April 28, 2014 5:50 PM
Points: 37, Visits: 303
Hi All,

I have been trying to findout the logins that were created or dropped in past few days. I queried the default trace. I queried on the event calss 'Audit Addlogin Event Class'. But it does not return any values. Can any one tell me what IU am doing wrong. Below is the query I used.

declare @path varchar(255)
SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'
FROM sys.traces
SELECT
TE.name As EventClassDescrip, T.EventClass,T.*
FROM ::fn_trace_gettable(@path, default) T
INNER JOIN sys.trace_events TE ON T.EventClass = TE.trace_event_id
WHERE EventClass = 104

Post #1386626
Posted Monday, November 19, 2012 10:14 PM
SSC Journeyman

SSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC Journeyman

Group: General Forum Members
Last Login: Tuesday, October 7, 2014 4:04 PM
Points: 93, Visits: 262
http://msdn.microsoft.com/en-us/library/ms188228.aspx
Post #1386680
Posted Thursday, November 22, 2012 12:44 AM


SSCertifiable

SSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiable

Group: General Forum Members
Last Login: Yesterday @ 7:06 PM
Points: 7,125, Visits: 12,720
The only thing I see you are missing is the check for is_default. If you have any other traces running on the instance you may be picking up that one. Try this:

DECLARE @path NVARCHAR(260);

SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'
FROM sys.traces
WHERE is_default = 1;

SELECT *
FROM sys.fn_trace_gettable(@path, DEFAULT) t
LEFT JOIN sys.trace_events te ON t.EventClass = te.trace_event_id
WHERE t.EventClass = 104
ORDER BY StartTime DESC;



__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community. --Plato
Post #1387743
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse