I have been trying to findout the logins that were created or dropped in past few days. I queried the default trace. I queried on the event calss 'Audit Addlogin Event Class'. But it does not return any values. Can any one tell me what IU am doing wrong. Below is the query I used.
declare @path varchar(255)
SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'
TE.name As EventClassDescrip, T.EventClass,T.*
FROM ::fn_trace_gettable(@path, default) T
INNER JOIN sys.trace_events TE ON T.EventClass = TE.trace_event_id
WHERE EventClass = 104