Audit

Question

Post reply

Audit

sqlguru

SSC-Addicted

Points: 471
More actions
February 8, 2021 at 8:51 pm

#3842643

Look to track audit for the audit actions?
Database system starts, stops, and restarts
Actions which result in the modification or deletion of data
All actions made by privileged users (database administrators)

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Jeff Moden SSC Guru Points: 1003921 More actions · Answer 1

I can't help but notice the irony here.. Interesting question coming from someone with a handle of "sqlguru". 😉

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

David Burrows SSC Guru Points: 65138 More actions · Answer 2

Jeff Moden wrote:

I can't help but notice the irony here.. Interesting question coming from someone with a handle of "sqlguru". 😉

Maybe you should change your handle to SQL God cos you are a God (or al least a legend) 🙂

Far away is close at hand in the images of elsewhere.
Anon.

Grant Fritchey SSC Guru Points: 398716 More actions · Answer 3

Some combination of Extended Events, Change Data Capture and SQL Audit are what you're looking for. One thing to note, Change Data Capture modifies the data structure. Extended Events, depending on how you define them, capture metric tonnes of data. SQL Audit also captures quite a bit of data (using Extended Events under the covers). The exact mix of which of these technologies are going to answer your questions requires quite a bit more in the way of details.

By the way, this comes up all the time. Usually the question gets expanded "Can we audit what privileged users do without them knowing we're auditing and without them being able to turn it off?" Shortest possible answer is, no. Someone who has administrative access to your system, has administrative access to your system. If you don't trust these people, fire them and get new ones, or at least limit their access more, making them less privileged.

"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
- Theodore Roosevelt

Author of:
SQL Server Execution Plans
SQL Server Query Performance Tuning

Jeff Moden SSC Guru Points: 1003921 More actions · Answer 4

David Burrows wrote:

Jeff Moden wrote:
I can't help but notice the irony here.. Interesting question coming from someone with a handle of "sqlguru". 😉
Maybe you should change your handle to SQL God cos you are a God (or al least a legend) 🙂

Thank you for the compliment, David, but I'm not even close to being what anyone should consider to be a "god" in SQL nor even a "guru". Anyone claiming to be either better be able to prove it in all areas and I know I can't. SQL Server is just too big for anyone to make or even infer such a claim.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)