Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

Trace login created or dropped event Expand / Collapse
Author
Message
Posted Monday, November 19, 2012 3:54 PM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Tuesday, April 08, 2014 6:07 PM
Points: 37, Visits: 296
Hi All,

I have been trying to findout the logins that were created or dropped in past few days. I queried the default trace. I queried on the event calss 'Audit Addlogin Event Class'. But it does not return any values. Can any one tell me what IU am doing wrong. Below is the query I used.

declare @path varchar(255)
SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'
FROM sys.traces
SELECT
TE.name As EventClassDescrip, T.EventClass,T.*
FROM ::fn_trace_gettable(@path, default) T
INNER JOIN sys.trace_events TE ON T.EventClass = TE.trace_event_id
WHERE EventClass = 104

Post #1386626
Posted Monday, November 19, 2012 10:14 PM
SSC Journeyman

SSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC JourneymanSSC Journeyman

Group: General Forum Members
Last Login: Sunday, January 13, 2013 11:24 PM
Points: 93, Visits: 259
http://msdn.microsoft.com/en-us/library/ms188228.aspx
Post #1386680
Posted Thursday, November 22, 2012 12:44 AM


SSCertifiable

SSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiableSSCertifiable

Group: General Forum Members
Last Login: Wednesday, April 16, 2014 9:25 AM
Points: 7,070, Visits: 12,523
The only thing I see you are missing is the check for is_default. If you have any other traces running on the instance you may be picking up that one. Try this:

DECLARE @path NVARCHAR(260);

SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'
FROM sys.traces
WHERE is_default = 1;

SELECT *
FROM sys.fn_trace_gettable(@path, DEFAULT) t
LEFT JOIN sys.trace_events te ON t.EventClass = te.trace_event_id
WHERE t.EventClass = 104
ORDER BY StartTime DESC;



__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community. --Plato

Believe you can and you're halfway there. --Theodore Roosevelt

Everything Should Be Made as Simple as Possible, But Not Simpler --Albert Einstein

The significant problems we face cannot be solved at the same level of thinking we were at when we created them. --Albert Einstein

1 apple is not exactly 1/8 of 8 apples. Because there are no absolutely identical apples. --Giordy
Post #1387743
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse