Click here to monitor SSC
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

Reverse Engineering a Server Side Trace Expand / Collapse
Author
Message
Posted Tuesday, March 23, 2010 12:02 AM


SSChampion

SSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampion

Group: General Forum Members
Last Login: Today @ 6:41 PM
Points: 14,541, Visits: 38,384
Comments posted to this topic are about the item Reverse Engineering a Server Side Trace

Lowell

--
help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!
Post #887852
Posted Tuesday, March 23, 2010 1:08 AM


SSC-Insane

SSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-Insane

Group: General Forum Members
Last Login: Monday, November 21, 2016 11:03 AM
Points: 20,009, Visits: 18,255
Excellent topic and excellent article.

Thanks Lowell. This is very useful stuff to have in the tool-belt.




Jason AKA CirqueDeSQLeil
I have given a name to my pain...
MCM SQL Server, MVP


SQL RNNR

Posting Performance Based Questions - Gail Shaw
Post #887874
Posted Tuesday, March 23, 2010 3:04 AM
Old Hand

Old HandOld HandOld HandOld HandOld HandOld HandOld HandOld Hand

Group: General Forum Members
Last Login: 2 days ago @ 2:56 AM
Points: 319, Visits: 1,156
Great article, this will be very useful.

I spotted a typo on line 65 of your stored proc:

from ::fn_trace_geteventinfo(1) AS X

...should be:

from ::fn_trace_geteventinfo(@traceid) AS X

Cheers
Chris
Post #887911
Posted Tuesday, March 23, 2010 6:11 AM


SSChampion

SSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampion

Group: General Forum Members
Last Login: Today @ 6:41 PM
Points: 14,541, Visits: 38,384
Thank you for the salute Jason and Thanks for identifying the fix, Chris;

Something that might escape some folks is did you know that C2 auditing is just another version of a trace?
a lot of people think it's one of those black box/magical complex things only super dba's know, and it's all requirement for SOX compliance.

fortunately, a trace is a trace...it's just 1100 lines of events it is going to capture, compared to ~770 for the default trace.

As an example, here are a couple of traces I ran off of my SLQ2008 server; one is the trace created by C2 Auditing, and the other is one created from the default trace.
c2_audit_trace_script.txt
default_trace_script.txt

I just love looking at the details i guess.
To do it yourself, it really easy to enable the C2 Auditing to test this: it's in the SSMS, you simply right click on your server, select properties, and there is a check box on the security tab.

The C2 Audit requires a start and stop of the SQL Server to get it in place, and it becomes traceid 1, with the default trace = traceid 2; I had really grown accustomed to the default trace being traceid = 1, so it was another thing to learn on this one that it could move around.
here is a link to download the version whitht he correction that Chris identified:
sp_ScriptAnyTrace.txt


Lowell

--
help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!
Post #888016
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse