Click here to monitor SSC
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


What, when and who? Auditing 101 - Part 3


What, when and who? Auditing 101 - Part 3

Author
Message
Roy Ernest
Roy Ernest
Hall of Fame
Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)

Group: General Forum Members
Points: 3172 Visits: 6862
Comments posted to this topic are about the item What, when and who? Auditing 101 - Part 3

-Roy
bmcateer
bmcateer
Forum Newbie
Forum Newbie (5 reputation)Forum Newbie (5 reputation)Forum Newbie (5 reputation)Forum Newbie (5 reputation)Forum Newbie (5 reputation)Forum Newbie (5 reputation)Forum Newbie (5 reputation)Forum Newbie (5 reputation)

Group: General Forum Members
Points: 5 Visits: 2
You have a typo in your code: "WriteToApllicationLog" ;-)
computrion
computrion
Forum Newbie
Forum Newbie (9 reputation)Forum Newbie (9 reputation)Forum Newbie (9 reputation)Forum Newbie (9 reputation)Forum Newbie (9 reputation)Forum Newbie (9 reputation)Forum Newbie (9 reputation)Forum Newbie (9 reputation)

Group: General Forum Members
Points: 9 Visits: 78
Very nice feature and article, this will full fill so many cases but for some real auditing this needs to be get more matured.

I have two informations to share here, one is good and the other one is bad.

first the good one.
SQLCat has build some code to collect audited data, which can be modified as per need.

http://sqlcat.codeplex.com/wikipage?title=sqlauditcentral&referringTitle=Home


secondly the bad thing.
We have some limitations of seeing parameterized value, sometimes (in my case most of the time) SQL audit is unable to capture the actual value, which was passes using variable to stored procedure or sql query.


https://connect.microsoft.com/SQLServer/feedback/details/624935/sql-server-2008-database-audit-on-insert-update-and-delete-actual-sql-and-not-parameter-values



Bye.
Achilies
Achilies
Old Hand
Old Hand (327 reputation)Old Hand (327 reputation)Old Hand (327 reputation)Old Hand (327 reputation)Old Hand (327 reputation)Old Hand (327 reputation)Old Hand (327 reputation)Old Hand (327 reputation)

Group: General Forum Members
Points: 327 Visits: 456
Can you please also make an article how to take the sql audit logs to a sql table using ssis/whichever way is easier?


Thanks.
Roy Ernest
Roy Ernest
Hall of Fame
Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)

Group: General Forum Members
Points: 3172 Visits: 6862
bmcateer (5/31/2012)
You have a typo in your code: "WriteToApllicationLog" ;-)

Thx for pointing it out. :-) Next time I will be more careful. :-)

-Roy
Roy Ernest
Roy Ernest
Hall of Fame
Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)

Group: General Forum Members
Points: 3172 Visits: 6862
Hi Computrion, Thx for links. Yes, I noticed that the SQL Audit does not catch all the values.

-Roy
Roy Ernest
Roy Ernest
Hall of Fame
Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)

Group: General Forum Members
Points: 3172 Visits: 6862
Beginner2008, Thx. You gave me an idea for the next article. I will try to do one regarding capturing the auditing data and writing it to a Table.

-Roy
jfogel
jfogel
Mr or Mrs. 500
Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)

Group: General Forum Members
Points: 557 Visits: 1162
UPDATE [dbo].[tbProducts] set [ProductCost] = @1 WHERE [ProductID]=@2

For my test using 2008 R2 I actually got the values used in the update statement and not variables. I got:

update dbo.tbProducts Set ProductCost = 2750 where ProductID = 1

Is this a 2008 vs R2 thing?

Cheers
Roy Ernest
Roy Ernest
Hall of Fame
Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)Hall of Fame (3.2K reputation)

Group: General Forum Members
Points: 3172 Visits: 6862
Yes it is. The behavior changes even for different level of Service packs unfortunately.

-Roy
jfogel
jfogel
Mr or Mrs. 500
Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)Mr or Mrs. 500 (557 reputation)

Group: General Forum Members
Points: 557 Visits: 1162
Noted. Thanks for the article.

Cheers
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search