Foglight Limitations for Monitoring a Specific Database User’s Activity (4383818)

A request was made to monitor a specific database user and generate reports detailing all queries executed, including detecting large data reads or excessive activity.

Foglight can provide some visibility into user activity, such as active sessions and resource usage, and can raise alerts when queries consume excessive resources.

Foglight is designed for performance monitoring, not detailed user activity auditing.

It collects data using sampling and aggregation, which means:

• It does not capture every query execution
• Short or fast queries may not be recorded
• It does not maintain a complete history of all user actions

Because of this design, Foglight cannot provide a full or guaranteed record of everything a specific user executes.

What can be done in Foglight

Foglight can help monitor the impact of a specific user:

• View active sessions and SQL by filtering on the user
• Identify heavy queries (high CPU, long duration, large reads)
• Configure alerts to detect abnormal or high-cost activity
• Generate reports showing top SQL and resource usage by user

This allows you to detect if the user is causing performance issues.

What Foglight cannot provide

Foglight cannot:

• Capture every query executed by a user
• Provide a complete audit trail
• Guarantee full visibility into all user actions

Recommended approach

To fully track and control what a specific user is doing, use database-native auditing tools alongside Foglight.

For example (SQL Server):

• SQL Server Audit or Extended Events can capture:
  • Exact queries executed
  • Number of reads
  • Execution details for that specific user

Summary

• Use Foglight to monitor performance and detect issues
• Use database auditing to track exact user activity

This combined approach provides both visibility and control.