Great Article! I am doing this kind of auditing on all my servers.

I would *not* filter by database Id though. cross-database queries can come from the "unexpected" master,tempdb,etc... system databases. The real approach is definitely logon triggers but 2005 is a requirement for that 🙂