not sure if that's an issue or not. on my test server, i did exactly this code, and see the command text for both;
regardless of whether the command text is visible int he grid or not, the event does show up int eh DDL as CREATE LOGIN, and the object name is the name of the login too.
so i don't see an error, just a situation where you are nto seeing an expected value.what is it that is not working.
we saved the xml event data itself, right there in the audit table, so you can see what raw data we processed anyway.
select that xml value, copy it and paste it into notepad or something.is the command text empty, or does it have a bunch of Carriage returns or something so it's hiding it in the grid?
Lowell