Chatee ahora con Soporte
Chat con el soporte

Change Auditor for SQL Server 7.1.1 - Event Reference Guide

Introduction

Change Auditor for SQL Server provides database auditing to secure SQL database assets with extensive, customizable auditing and reporting for critical SQL changes including broker, database, object, performance, transaction events, errors and warnings, and data changes. SQL auditing helps tighten enterprise-wide change and control policies by tracking user and administrator activity such as database additions and deletions, granting and removing SQL access, and so on.

To enable SQL Server auditing in Change Auditor, you must assign a SQL Auditing template to Change Auditor agents. Change Auditor for SQL Server ships with a predefined SQL Auditing template that you can use to audit key events on the default SQL Server instance or you can create a SQL auditing template to specify the SQL instances and SQL Server operations to audit.

In addition to real-time auditing, you can also enable event logging to capture SQL Server events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

* 
NOTE: SQL Server auditing and event logging are only available when you have licensed Change Auditor for SQL Server and assigned a SQL Auditing template to your agents. Contact your Sales Representative for more information about obtaining Change Auditor for SQL Server.

This guide lists the events that are captured by Change Auditor for SQL Server. Separate event reference guides are available that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for SQL Server Events

This section lists the audited events specific to Change Auditor for SQL Server. It also lists each event’s corresponding severity setting. Audited events are listed in alphabetical order by facility:

•
SQL Broker Event
•
SQL CLR Event
•
SQL Cursors Event
•
SQL Database Event
•
SQL Deprecation Event
•
SQL Errors and Warnings Event
•
SQL Full Text Event
•
SQL Locks Event
•
SQL Objects Event
•
SQL OLEDB Event
•
SQL Performance Event
•
SQL Progress Report Event
•
SQL Query Notifications Event
•
SQL Scan Event
•
SQL Security Audit Event
•
SQL Server Event
•
SQL Session Event
•
SQL Stored Procedures Event
•
SQL Transactions Event
•
SQL TSQL Event
•
SQL User-Configurable Event
•
SQL Data Level Event

 

* 
IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.
 
* 
NOTE: To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the client. This page displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.

SQL Broker Event

The SQL Broker Event facility includes event classes that are produced by the Service Broker.

 
Table 1. SQL Broker events
Event
Description
Severity

Broker: Activation - Aborted

Created when a SQL Server activation stored procedure is aborted.

Medium

Broker: Activation – Ended

Created when a SQL Server activation stored procedure is ended.

Medium

Broker: Activation - Start

Created when SQL Server activation stored procedure is started.

Medium

Broker: Connection – Accept

Created when SQL Server has accepted a transport connection from another instance.

Medium

Broker: Connection – Closed

Created when a SQL Server has closed the transport connection.

Medium

Broker: Connection - Closing

Created when a SQL Server is closing the transport connection.

Medium

Broker: Connection – Connect Failed

Created when a SQL Server fails to establish a transport connection.

Medium

Broker: Connection – Connected

Created when a SQL Server has established a transport connection.

Medium

Broker: Connection - Connecting

Created when a SQL Server is initiating a transport connection.

Medium

Broker: Connection – Receive IO Error

Created when a SQL Server encounters a transport error while receiving a message.

Medium

Broker: Connection – Send IO Error

Created when a SQL Server encounters a transport error while sending a message.

Medium

Broker: Conversation – Begin Dialog

Created when the Database Engine executes a Begin Dialog command.

Medium

Broker: Conversation – Broker Initiated Error

Created when the Service Broker creates an error message.

Medium

Broker: Conversation – Dialog Created

Created when the Service Broker creates an endpoint for a dialog.

Medium

Broker: Conversation – End Conversation

Created when the Database Engine executes an END CONVERSATION statement that does not include the WITH ERROR clause.

Medium

Broker: Conversation – End Conversation with Cleanup

Created when the Database Engine executes an END CONVERSATION statement that includes the WITH CLEANUP CLAUSE.

Medium

Broker: Conversation – End Conversation with Error

Created when the Database Engine executes an END CONVERSATION statement that includes the WITH ERROR clause.

Medium

Broker: Conversation – Received Broker Error Message

Created when the Service Broker receives a broker-defined error message from the other side of the conversation.

Medium

Broker: Conversation – Received End Conversation

Created when SQL Server receives an End Dialog message from the other side of the conversation.

Medium

Broker: Conversation – Received End Conversation Ack

Created when the other side of a conversation acknowledged an End Dialog or Error message sent by this side of the conversation.

Medium

Broker: Conversation – Received End Conversation with Error

Created when SQL Server receives a user-defined error from the other side of the conversation.

Medium

Broker: Conversation – Received Sequenced Message

Created when SQL Server receives a message that contains a message sequence number.

Medium

Broker: Conversation – Send Message

Created when the Database Engine executes a SEND statement.

Medium

Broker: Conversation – Terminate Dialog

Created when the Service Broker terminates the dialog.

Medium

Broker: Conversation Group – Create

Created when SQL Server creates a new conversation group.

Medium

Broker: Conversation Group – Drop

Created when SQL Server deletes a conversation group.

Medium

Broker: Corrupted Message

Created when the Service Broker receives a corrupted message.

Medium

Broker: Forwarded Message Dropped

Created when the Service Broker drops a message that was intended to be forwarded.

Medium

Broker: Forwarded Message Sent

Created when the Service Broker forwards a message.

Medium

Broker: Message Classify – Delayed

Created when the Service Broker delayed the routing for a message. (Disabled by default)

Medium

Broker: Message Classify - Local

Created when the Service Broker determines the routing for a local message.

Medium

Broker: Message Classify – Remote

Created when the Service Broker determines the routing for a remote message.

Medium

Broker: Mirrored Route State Changed

Created when the mirrored route state changes on the Service Broker.

Medium

Broker: Queue Disabled

Created when a poison message is detected because there are five consecutive transaction rollbacks on a Service Broker queue.

Medium

Broker: Remote Message Ack – Acknowledgment Received

Created when the Service Broker receives an acknowledgment outside of a normal sequenced message

Medium

Broker: Remote Message Ack - Acknowledgment Sent

Created when the Service Broker sends an acknowledgment outside of a normal sequenced message.

Medium

Broker: Remote Message Ack – Message with Acknowledgment Received

Created when the Service Broker receives an acknowledgment as part of a normal sequenced message.

Medium

Broker: Remote Message Ack – Message with Acknowledgment Sent

Created when the Service Broker sends an acknowledgment as part of a normal sequenced message.

Medium

Broker: Sequenced Message Undeliverable

Created when the Service Broker is unable to retain a received sequenced message that should have been delivered to a service.

Medium

Broker: Transmission

Created when an error has occurred in the Service Broker transport layer.

Medium

Broker: Unsequenced Message Undeliverable

Create when the Service Broker is unable to retain a received unsequenced message that should have been delivered to a service.

Medium

SQL CLR Event

The SQL CLR Event facility includes event classes that are produced by the execution of .NET Common Language Runtime (CLR) objects inside SQL Server.

 
Table 2. SQL CLR event
Event
Description
Severity

Assembly Load

Created when a request to load the assembly results in an error.

Medium

Herramientas de autoservicio
Base de conocimientos
Notificaciones y alertas
Soporte de productos
Descargas de software
Documentación técnica
Foros de usuarios
Tutoriales en video
Aviso de actualizaciones de páginas web (RSS)
Comuníquese con nosotros
Obtenga asistencia con las licencias
Soporte Técnico
Ver todos
Documentos relacionados

The document was helpful.

Seleccionar calificación

I easily found the information I needed.

Seleccionar calificación