Post reply

Is there any way I can find out who deleted the database?

  • March 26, 2008 at 11:11 am

    #794219

    Thanks for the info Buxton. I will have to look into this. I did not even know this was possible.


    My blog: http://jahaines.blogspot.com

  • March 26, 2008 at 11:12 am

    #794221

    Todd,

    I am not sure how this would work. This function is used to import trace files from SQL profiler. In order for this to work, the OP would have had to been running profiler.

    An I missing something?

    The default out-of-box for SQL 2005 is to have a default trace running. Not to be confused with the black-box trace which has a rollover at 5 or 10MB and isn't running by default.

    Here's what it's capturing: Default Trace in SQL Server 2005

    If you view sys.traces the default trace should be listed as ID 1.

  • March 26, 2008 at 11:16 am

    #794222

    The default out-of-box for SQL 2005 is to have a default trace running. Not to be confused with the black-box trace which has a rollover at 5 or 10MB and isn't running by default.

    Here's what it's capturing: Default Trace in SQL Server 2005

    If you view sys.traces the default trace should be listed as ID 1.

    Thanks for the info and link :).


    My blog: http://jahaines.blogspot.com

  • March 26, 2008 at 11:40 am

    #794234

    Totally awesome find... but despite the DROPS I've done on tables and the like, there's nothing in the log. There is something, however, for someone dropping a database.... gives machine name, login name, etc.

    I created just a simple database called "DropTest" and then turned right around and dropped it using the following command...

    DROP DATABASE DROPTEST

    The trace function had this in the trc table along with some other goodies on the same line...

    DBCC CALLFULLTEXT ( 7, @dbid ) -- FTDropAllCatalogs ( "@dbid" )

    ... same thing shows up for clicking a delete on the database.

    So there you have it... the smoking gun you've been looking for... at least you can narrow it down to which machine they did it from. That's usually pretty handy for identifying who did it.

    I'd do my investigation using this in private... it would be a real bugger if you showed it off and it turns out that the DROP DATABASE came from your machine... and DBA's should ALWAYS lock there machine before they stand up... so you won't even be able to blame anyone on that if it turns out to be your machine. 😛

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)

  • March 26, 2008 at 12:11 pm

    #794258

    Hmm - I'm seeing dropped tables....You looking at the right trace? mine seems to automatically roll over after a certain size.

    Look at the ObjectName column? I'm seeing table names, indexes, etc....

    I'm surprised it doesn't capture the statement causing the action, but still - you do have some log.

    ----------------------------------------------------------------------------------
    Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?

  • March 26, 2008 at 12:16 pm

    #794261

    Matt Miller (3/26/2008)

    Hmm - I'm seeing dropped tables....You looking at the right trace? mine seems to automatically roll over after a certain size.

    I think so... here's the command I'm using... I apparently haven't reached the size limit yet... goes all the way back to Jan 2008...

    SELECT *

    FROM fn_trace_gettable

    ('C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log.trc', default)

    WHERE TextData LIKE '%DROP%'

    GO

    What are you using, Matt?

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)

  • March 26, 2008 at 12:22 pm

    #794264

    Jeff,

    Try changing "DROP" to "DELETE", or set a WHERE clause with EventClass = 47 for Object : Deleted events.

    Opening the traces in Profiler will resolve the EventClass to readable names too.

  • March 26, 2008 at 12:27 pm

    #794269

    I just went and opened the trace up (double-click on the file mentioned)...they all show up as Object:Deleted/Altered/created (which is probably why you can't see it - it doesn't mention DROP)

    Note: although they're separate files, they act as one trace. If you open any one of them using profiler, it will prompt you to load the rest that follows (which sounds like what the system function is automatically doing).

    The "log.trc" notation Also looks to be a "logical one" (meaning if you look in the actual directory - you may find it's not log.trc, but in reality one or more log_XXX.trc files, which get treated as one).

    Interestingly enough - The EventClass is a NUMBER in the function, but it's an actual description (as in Object:Deleted) when you look at it through profiler. Sounds like we need to link to something to get a meaningful name....

    ----------------------------------------------------------------------------------
    Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?

  • March 26, 2008 at 12:28 pm

    #794271

    Hmmmm.........I only have 1 log.trc file in an unused folder, last modified on 8/2007

  • March 26, 2008 at 12:32 pm

    #794274

    homebrew01 (3/26/2008)

    Hmmmm.........I only have 1 log.trc file in an unused folder, last modified on 8/2007

    Did you query sys.traces? If it's running, the location will be shown there as well.

  • March 26, 2008 at 12:43 pm

    #794282

    Todd Engen (3/26/2008)

    Did you query sys.traces? If it's running, the location will be shown there as well.

    Thanks .... that fixed it. Although I'm spoiled with Compliance Manager on most of our SQL boxes, but this might come in handy on non-monitored servers.

    I only see the last 4 hours though.

  • March 26, 2008 at 12:51 pm

    #794285

    Todd Engen (3/26/2008)

    Jeff,

    Try changing "DROP" to "DELETE", or set a WHERE clause with EventClass = 47 for Object : Deleted events.

    Opening the traces in Profiler will resolve the EventClass to readable names too.

    Perfect... I'll give that a try. Thanks, Tod.

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)

  • March 26, 2008 at 1:11 pm

    #794306

    I was thinking about this myself. I then found this online.

    -- DEMO: Create an EventId table and populate it with definitions of each ID number

    CREATE TABLE sp_EventID_Table (ID int, Description varchar(50) )

    GO

    SET NOCOUNT ON

    GO

    INSERT INTO sp_EventID_Table VALUES (0, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (1, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (2, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (3, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (4, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (5, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (6, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (7, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (8, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (9, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (10, 'RPC:Completed')

    INSERT INTO sp_EventID_Table VALUES (11, 'RPC:Starting')

    INSERT INTO sp_EventID_Table VALUES (12, 'SQL:BatchCompleted')

    INSERT INTO sp_EventID_Table VALUES (13, 'SQL:BatchStarting')

    INSERT INTO sp_EventID_Table VALUES (14, 'Login')

    INSERT INTO sp_EventID_Table VALUES (15, 'Logout')

    INSERT INTO sp_EventID_Table VALUES (16, 'Attention')

    INSERT INTO sp_EventID_Table VALUES (17, 'ExistingConnection')

    INSERT INTO sp_EventID_Table VALUES (18, 'ServiceControl')

    INSERT INTO sp_EventID_Table VALUES (19, 'DTCTransaction')

    INSERT INTO sp_EventID_Table VALUES (20, 'Login Failed')

    INSERT INTO sp_EventID_Table VALUES (21, 'EventLog')

    INSERT INTO sp_EventID_Table VALUES (22, 'ErrorLog')

    INSERT INTO sp_EventID_Table VALUES (23, 'Lock:Released')

    INSERT INTO sp_EventID_Table VALUES (24, 'Lock:Acquired')

    INSERT INTO sp_EventID_Table VALUES (25, 'Lock:Deadlock')

    INSERT INTO sp_EventID_Table VALUES (26, 'Lock:Cancel')

    INSERT INTO sp_EventID_Table VALUES (27, 'Lock:Timeout')

    INSERT INTO sp_EventID_Table VALUES (28, 'DOP Event')

    INSERT INTO sp_EventID_Table VALUES (29, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (30, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (31, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (32, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (33, 'Exception')

    INSERT INTO sp_EventID_Table VALUES (34, 'SP:CacheMiss')

    INSERT INTO sp_EventID_Table VALUES (35, 'SP:CacheInsert')

    INSERT INTO sp_EventID_Table VALUES (36, 'SP:CacheRemove')

    INSERT INTO sp_EventID_Table VALUES (37, 'SP:Recompile')

    INSERT INTO sp_EventID_Table VALUES (38, 'SP:CacheHit')

    INSERT INTO sp_EventID_Table VALUES (39, 'SP:ExecContextHit')

    INSERT INTO sp_EventID_Table VALUES (40, 'SQL:StmtStarting')

    INSERT INTO sp_EventID_Table VALUES (41, 'SQL:StmtCompleted')

    INSERT INTO sp_EventID_Table VALUES (42, 'SP:Starting')

    INSERT INTO sp_EventID_Table VALUES (43, 'SP:Completed')

    INSERT INTO sp_EventID_Table VALUES (44, 'SP:StmtStarting')

    INSERT INTO sp_EventID_Table VALUES (45, 'SP:StmtCompleted')

    INSERT INTO sp_EventID_Table VALUES (46, 'Object:Created')

    INSERT INTO sp_EventID_Table VALUES (47, 'Object:Deleted')

    INSERT INTO sp_EventID_Table VALUES (48, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (49, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (50, 'SQL Transaction')

    INSERT INTO sp_EventID_Table VALUES (51, 'Scan:Started')

    INSERT INTO sp_EventID_Table VALUES (52, 'Scan:Stopped')

    INSERT INTO sp_EventID_Table VALUES (53, 'CursorOpen')

    INSERT INTO sp_EventID_Table VALUES (54, 'Transaction Log')

    INSERT INTO sp_EventID_Table VALUES (55, 'Hash Warning')

    INSERT INTO sp_EventID_Table VALUES (56, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (57, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (58, 'Auto Update Stats')

    INSERT INTO sp_EventID_Table VALUES (59, 'Lock:Deadlock Chain')

    INSERT INTO sp_EventID_Table VALUES (60, 'Lock:Escalation')

    INSERT INTO sp_EventID_Table VALUES (61, 'OLE DB Errors')

    INSERT INTO sp_EventID_Table VALUES (62, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (63, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (64, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (65, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (66, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (67, 'Execution Warnings')

    INSERT INTO sp_EventID_Table VALUES (68, 'Execution Plan')

    INSERT INTO sp_EventID_Table VALUES (69, 'Sort Warnings')

    INSERT INTO sp_EventID_Table VALUES (70, 'CursorPrepare')

    INSERT INTO sp_EventID_Table VALUES (71, 'Prepare SQL')

    INSERT INTO sp_EventID_Table VALUES (72, 'Exec Prepared SQL')

    INSERT INTO sp_EventID_Table VALUES (73, 'Unprepare SQL')

    INSERT INTO sp_EventID_Table VALUES (74, 'CursorExecute')

    INSERT INTO sp_EventID_Table VALUES (75, 'CursorRecompile')

    INSERT INTO sp_EventID_Table VALUES (76, 'CursorImplicitConversion')

    INSERT INTO sp_EventID_Table VALUES (77, 'CursorUnprepare')

    INSERT INTO sp_EventID_Table VALUES (78, 'CursorClose')

    INSERT INTO sp_EventID_Table VALUES (79, 'Missing Column Statistics')

    INSERT INTO sp_EventID_Table VALUES (80, 'Missing Join Predicate')

    INSERT INTO sp_EventID_Table VALUES (81, 'Server Memory Change')

    INSERT INTO sp_EventID_Table VALUES (82, 'User Configurable 0')

    INSERT INTO sp_EventID_Table VALUES (83, 'User Configurable 1')

    INSERT INTO sp_EventID_Table VALUES (84, 'User Configurable 2')

    INSERT INTO sp_EventID_Table VALUES (85, 'User Configurable 3')

    INSERT INTO sp_EventID_Table VALUES (86, 'User Configurable 4')

    INSERT INTO sp_EventID_Table VALUES (87, 'User Configurable 5')

    INSERT INTO sp_EventID_Table VALUES (88, 'User Configurable 6')

    INSERT INTO sp_EventID_Table VALUES (89, 'User Configurable 7')

    INSERT INTO sp_EventID_Table VALUES (90, 'User Configurable 8')

    INSERT INTO sp_EventID_Table VALUES (91, 'User Configurable 9')

    INSERT INTO sp_EventID_Table VALUES (92, 'Data File Auto Grow')

    INSERT INTO sp_EventID_Table VALUES (93, 'Log File Auto Grow')

    INSERT INTO sp_EventID_Table VALUES (94, 'Data File Auto Shrink')

    INSERT INTO sp_EventID_Table VALUES (95, 'Log File Auto Shrink')

    INSERT INTO sp_EventID_Table VALUES (96, 'Show Plan Text')

    INSERT INTO sp_EventID_Table VALUES (97, 'Show Plan ALL')

    INSERT INTO sp_EventID_Table VALUES (98, 'Show Plan Statistics')

    INSERT INTO sp_EventID_Table VALUES (99, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (100, 'RPC Output Parameter')

    INSERT INTO sp_EventID_Table VALUES (101, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (102, 'Audit Statement GDR')

    INSERT INTO sp_EventID_Table VALUES (103, 'Audit Object GDR')

    INSERT INTO sp_EventID_Table VALUES (104, 'Audit Add/Drop Login')

    INSERT INTO sp_EventID_Table VALUES (105, 'Audit Login GDR')

    INSERT INTO sp_EventID_Table VALUES (106, 'Audit Login Change Property')

    INSERT INTO sp_EventID_Table VALUES (107, 'Audit Login Change Password')

    INSERT INTO sp_EventID_Table VALUES (108, 'Audit Add Login to Server Role')

    INSERT INTO sp_EventID_Table VALUES (109, 'Audit Add DB User')

    INSERT INTO sp_EventID_Table VALUES (110, 'Audit Add Member to DB')

    INSERT INTO sp_EventID_Table VALUES (111, 'Audit Add/Drop Role')

    INSERT INTO sp_EventID_Table VALUES (112, 'App Role Pass Change')

    INSERT INTO sp_EventID_Table VALUES (113, 'Audit Statement Permission')

    INSERT INTO sp_EventID_Table VALUES (114, 'Audit Object Permission')

    INSERT INTO sp_EventID_Table VALUES (115, 'Audit Backup/Restore')

    INSERT INTO sp_EventID_Table VALUES (116, 'Audit DBCC')

    INSERT INTO sp_EventID_Table VALUES (117, 'Audit Change Audit')

    INSERT INTO sp_EventID_Table VALUES (118, 'Audit Object Derived Permission')


    My blog: http://jahaines.blogspot.com

  • March 26, 2008 at 1:13 pm

    #794307

    You will notice the table is name sp. The online poster had a requirement where he wanted the table in the master database, thus the sp prefix.


    My blog: http://jahaines.blogspot.com

  • March 26, 2008 at 1:20 pm

    #794310

    Adam Haines (3/26/2008)

    I was thinking about this myself. I then found this online.

    -- DEMO: Create an EventId table and populate it with definitions of each ID number

    CREATE TABLE sp_EventID_Table (ID int, Description varchar(50) )

    GO

    SET NOCOUNT ON

    GO

    INSERT INTO sp_EventID_Table VALUES (0, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (1, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (2, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (3, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (4, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (5, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (6, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (7, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (8, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (9, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (10, 'RPC:Completed')

    INSERT INTO sp_EventID_Table VALUES (11, 'RPC:Starting')

    INSERT INTO sp_EventID_Table VALUES (12, 'SQL:BatchCompleted')

    INSERT INTO sp_EventID_Table VALUES (13, 'SQL:BatchStarting')

    INSERT INTO sp_EventID_Table VALUES (14, 'Login')

    INSERT INTO sp_EventID_Table VALUES (15, 'Logout')

    INSERT INTO sp_EventID_Table VALUES (16, 'Attention')

    INSERT INTO sp_EventID_Table VALUES (17, 'ExistingConnection')

    INSERT INTO sp_EventID_Table VALUES (18, 'ServiceControl')

    INSERT INTO sp_EventID_Table VALUES (19, 'DTCTransaction')

    INSERT INTO sp_EventID_Table VALUES (20, 'Login Failed')

    INSERT INTO sp_EventID_Table VALUES (21, 'EventLog')

    INSERT INTO sp_EventID_Table VALUES (22, 'ErrorLog')

    INSERT INTO sp_EventID_Table VALUES (23, 'Lock:Released')

    INSERT INTO sp_EventID_Table VALUES (24, 'Lock:Acquired')

    INSERT INTO sp_EventID_Table VALUES (25, 'Lock:Deadlock')

    INSERT INTO sp_EventID_Table VALUES (26, 'Lock:Cancel')

    INSERT INTO sp_EventID_Table VALUES (27, 'Lock:Timeout')

    INSERT INTO sp_EventID_Table VALUES (28, 'DOP Event')

    INSERT INTO sp_EventID_Table VALUES (29, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (30, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (31, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (32, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (33, 'Exception')

    INSERT INTO sp_EventID_Table VALUES (34, 'SP:CacheMiss')

    INSERT INTO sp_EventID_Table VALUES (35, 'SP:CacheInsert')

    INSERT INTO sp_EventID_Table VALUES (36, 'SP:CacheRemove')

    INSERT INTO sp_EventID_Table VALUES (37, 'SP:Recompile')

    INSERT INTO sp_EventID_Table VALUES (38, 'SP:CacheHit')

    INSERT INTO sp_EventID_Table VALUES (39, 'SP:ExecContextHit')

    INSERT INTO sp_EventID_Table VALUES (40, 'SQL:StmtStarting')

    INSERT INTO sp_EventID_Table VALUES (41, 'SQL:StmtCompleted')

    INSERT INTO sp_EventID_Table VALUES (42, 'SP:Starting')

    INSERT INTO sp_EventID_Table VALUES (43, 'SP:Completed')

    INSERT INTO sp_EventID_Table VALUES (44, 'SP:StmtStarting')

    INSERT INTO sp_EventID_Table VALUES (45, 'SP:StmtCompleted')

    INSERT INTO sp_EventID_Table VALUES (46, 'Object:Created')

    INSERT INTO sp_EventID_Table VALUES (47, 'Object:Deleted')

    INSERT INTO sp_EventID_Table VALUES (48, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (49, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (50, 'SQL Transaction')

    INSERT INTO sp_EventID_Table VALUES (51, 'Scan:Started')

    INSERT INTO sp_EventID_Table VALUES (52, 'Scan:Stopped')

    INSERT INTO sp_EventID_Table VALUES (53, 'CursorOpen')

    INSERT INTO sp_EventID_Table VALUES (54, 'Transaction Log')

    INSERT INTO sp_EventID_Table VALUES (55, 'Hash Warning')

    INSERT INTO sp_EventID_Table VALUES (56, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (57, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (58, 'Auto Update Stats')

    INSERT INTO sp_EventID_Table VALUES (59, 'Lock:Deadlock Chain')

    INSERT INTO sp_EventID_Table VALUES (60, 'Lock:Escalation')

    INSERT INTO sp_EventID_Table VALUES (61, 'OLE DB Errors')

    INSERT INTO sp_EventID_Table VALUES (62, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (63, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (64, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (65, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (66, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (67, 'Execution Warnings')

    INSERT INTO sp_EventID_Table VALUES (68, 'Execution Plan')

    INSERT INTO sp_EventID_Table VALUES (69, 'Sort Warnings')

    INSERT INTO sp_EventID_Table VALUES (70, 'CursorPrepare')

    INSERT INTO sp_EventID_Table VALUES (71, 'Prepare SQL')

    INSERT INTO sp_EventID_Table VALUES (72, 'Exec Prepared SQL')

    INSERT INTO sp_EventID_Table VALUES (73, 'Unprepare SQL')

    INSERT INTO sp_EventID_Table VALUES (74, 'CursorExecute')

    INSERT INTO sp_EventID_Table VALUES (75, 'CursorRecompile')

    INSERT INTO sp_EventID_Table VALUES (76, 'CursorImplicitConversion')

    INSERT INTO sp_EventID_Table VALUES (77, 'CursorUnprepare')

    INSERT INTO sp_EventID_Table VALUES (78, 'CursorClose')

    INSERT INTO sp_EventID_Table VALUES (79, 'Missing Column Statistics')

    INSERT INTO sp_EventID_Table VALUES (80, 'Missing Join Predicate')

    INSERT INTO sp_EventID_Table VALUES (81, 'Server Memory Change')

    INSERT INTO sp_EventID_Table VALUES (82, 'User Configurable 0')

    INSERT INTO sp_EventID_Table VALUES (83, 'User Configurable 1')

    INSERT INTO sp_EventID_Table VALUES (84, 'User Configurable 2')

    INSERT INTO sp_EventID_Table VALUES (85, 'User Configurable 3')

    INSERT INTO sp_EventID_Table VALUES (86, 'User Configurable 4')

    INSERT INTO sp_EventID_Table VALUES (87, 'User Configurable 5')

    INSERT INTO sp_EventID_Table VALUES (88, 'User Configurable 6')

    INSERT INTO sp_EventID_Table VALUES (89, 'User Configurable 7')

    INSERT INTO sp_EventID_Table VALUES (90, 'User Configurable 8')

    INSERT INTO sp_EventID_Table VALUES (91, 'User Configurable 9')

    INSERT INTO sp_EventID_Table VALUES (92, 'Data File Auto Grow')

    INSERT INTO sp_EventID_Table VALUES (93, 'Log File Auto Grow')

    INSERT INTO sp_EventID_Table VALUES (94, 'Data File Auto Shrink')

    INSERT INTO sp_EventID_Table VALUES (95, 'Log File Auto Shrink')

    INSERT INTO sp_EventID_Table VALUES (96, 'Show Plan Text')

    INSERT INTO sp_EventID_Table VALUES (97, 'Show Plan ALL')

    INSERT INTO sp_EventID_Table VALUES (98, 'Show Plan Statistics')

    INSERT INTO sp_EventID_Table VALUES (99, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (100, 'RPC Output Parameter')

    INSERT INTO sp_EventID_Table VALUES (101, 'Reserved')

    INSERT INTO sp_EventID_Table VALUES (102, 'Audit Statement GDR')

    INSERT INTO sp_EventID_Table VALUES (103, 'Audit Object GDR')

    INSERT INTO sp_EventID_Table VALUES (104, 'Audit Add/Drop Login')

    INSERT INTO sp_EventID_Table VALUES (105, 'Audit Login GDR')

    INSERT INTO sp_EventID_Table VALUES (106, 'Audit Login Change Property')

    INSERT INTO sp_EventID_Table VALUES (107, 'Audit Login Change Password')

    INSERT INTO sp_EventID_Table VALUES (108, 'Audit Add Login to Server Role')

    INSERT INTO sp_EventID_Table VALUES (109, 'Audit Add DB User')

    INSERT INTO sp_EventID_Table VALUES (110, 'Audit Add Member to DB')

    INSERT INTO sp_EventID_Table VALUES (111, 'Audit Add/Drop Role')

    INSERT INTO sp_EventID_Table VALUES (112, 'App Role Pass Change')

    INSERT INTO sp_EventID_Table VALUES (113, 'Audit Statement Permission')

    INSERT INTO sp_EventID_Table VALUES (114, 'Audit Object Permission')

    INSERT INTO sp_EventID_Table VALUES (115, 'Audit Backup/Restore')

    INSERT INTO sp_EventID_Table VALUES (116, 'Audit DBCC')

    INSERT INTO sp_EventID_Table VALUES (117, 'Audit Change Audit')

    INSERT INTO sp_EventID_Table VALUES (118, 'Audit Object Derived Permission')

    Or - you use the sys.trace_events view (looks to have all of these and then some.)

    ----------------------------------------------------------------------------------
    Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?

Viewing 15 posts - 16 through 30 (of 44 total)

You must be logged in to reply to this topic. Login to reply