November 15, 2019 at 1:30 pm
The auditee I am reviewing has triggers (INSERT, UPDATE, DELETE) configured for multiple tables. However, the application/database package they purchase had things already configured for them, they did not set anything up themselves. For an audit log review, they are reviewing the audit log as they have a server audit specification configured.
My question is, would any results from activity (modifications to tables) that would cause the triggers to fire be recorded in the audit log, or would it end up in the SQL Server log. My understanding was that the SQL Server log was mostly for any errors that occured but I could be wrong.
November 15, 2019 at 1:43 pm
Can you post the DDL for one of the triggers, please, so we can see what it does? Normally an audit would capture a specified set of events without the need for triggers.
John
November 15, 2019 at 2:00 pm
I would say the DDL activity is being adequatelly captured by the change groups that are logged for through the audit specification. My concern is whether or not the DML activity is being review correctly. I don't have syntax for each of the triggers, only the table that shows the trigger name, the type of trigger and the table the trigger is for.
November 15, 2019 at 2:09 pm
As I understand it, you're asking where the activity that causes the triggers to fire would be recorded, yet you don't have access to the CREATE TRIGGER statements? It's difficult to answer without that information.
John
Viewing 4 posts - 1 through 3 (of 3 total)
You must be logged in to reply to this topic. Login to reply