Chat now with support
Chat with Support

Change Auditor for SQL Server 7.3 - Event Reference Guide

SQL Extended Events

The SQL Extended Events facility contains event classes that are used to monitor SQL data changes that are part of the Admin, Analytic, and Operational channels.

SQL Server Admin Extended Event

Created when an SQL Extended Event occurs in the Admin channel.

High

SQL Server Analytic Extended Event

Created when an SQL Server Analytic Extended Event occurs in the Analytic channel.

Medium

SQL Server Operational Extended Event

Created when an SQL Server Operational Extended Event occurs in the Operational channel.

Medium

 

Log Events

When event logging for SQL is enabled in Change Auditor, SQL events will be written to a Windows event log, named ChangeAuditor for SQL. This event log can then be gathered by InTrust for further processing and reporting.

NOTE: To enable event logging, select Event Logging on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to be enabled.

The following SQL events are recorded to the ChangeAuditor for SQL event log when SQL event logging is enabled. They are listed below in numeric order by Event ID.

2560

RPC: Completed

2816

RPC: Starting

3072

SQL: BatchCompleted

3328

SQL: BatchStarting

3584

Audit Login

3840

Audit Logout

4096

Attention Event

4609

Audit Server Shutdown

4610

Audit Server Start

4611

Audit Server Pause

4612

Audit Server Resume

4864

DTCTransaction – Get Address

4865

DTCTransaction – Propagate Transaction

4867

DTCTransaction – Close Connection

4870

DTCTransaction – Creating a new DTC Transaction

4871

DTCTransaction – Enlisting in a DTC Transaction

4872

DTCTransaction – Internal Active

4873

DTCTransaction – Internal Commit

4874

DTCTransaction – Internal Abort

4878

DTCTransaction – Preparing Transaction

4879

DTCTransaction – Transaction is Prepared

4880

DTCTransaction – Transaction is Aborting

4881

DTCTransaction – Transaction is Committing

4886

DTCTransaction – TM Failed While in Prepared State

4887

DTCTransaction – Unknown

5120

Audit Login Failed

5376

Event Logged

5632

Error Logged

5888

Lock: Released

6144

Lock: Acquired

6400

Lock: Deadlock

6656

Lock: Cancel

6912

Lock: Timeout

7169

Degree of Parallelism – Select

7170

Degree of Parallelism – Insert

7171

Degree of Parallelism – Update

7172

Degree of Parallelism – Delete

8448

Exception

8704

SP:CacheMiss

8960

SP:CacheInsert

9217

SP:CacheRemove – Compplan Remove

9218

SP:CacheRemove – Proc Cache Flush

9473

SP:Recompile – Schema Changed

9474

SP:Recompile – Statistics Changed

9475

SP:Recompile – Recompile DNR

9476

SP:Recompile – Set Option Changed

9477

SP:Recompile – Temp Table Changed

9478

SP:Recompile – Remote Rowset Changed

9479

SP:Recompile – Browse Perms Changed

9480

SP:Recompile – Query Notification Environment Changed

9481

SP:Recompile – MPI View Changed

9482

SP:Recompile – Cursor Options Changed

9483

SP:Recompile – Recompile Option

9729

SP:CacheHit – Execution Context Hit

9730

SP:CacheHit – Compplan Hit

10240

SQL:StmtStarting

10496

SQL:StmtCompleted

10752

SP:Starting

11008

SP:Completed

11264

SP:StmtStarting

11520

SP:StmtCompleted

11776

Object: Created – Begin

11777

Object: Created – Commit

11778

Object: Created – Rollback

12032

Object: Deleted – Begin

12033

Object: Deleted – Commit

12034

Object: Deleted – Rollback

12800

SQL Transaction Begin

12801

SQL Transaction Commit

12802

SQL Transaction Rollback

12803

SQL Transaction Savepoint

13056

Scan: Started

13312

Scan: Stopped

13568

Cursor – Open

13824

TransactionLog

14080

Hash Warning – Recursion

14081

Hash Warning – Bailout

14849

Auto Stats - Sync

14850

Auto Stats – Async Queued

14851

Auto Stats – Async Starting

14852

Auto Stats – Async Completed

15205

Lock: Deadlock Chain – Resource Type Lock

15206

Lock: Deadlock Chain – Resource Type Exchange

15360

Lock: Escalation

15616

OLEDB Errors

17153

Execution Warnings – Query Wait

17154

Execution Warnings – Query Timeout

17408

Showplan – Text (Unencoded)

17665

Sort Warnings – Single Pass

17666

Sort Warnings – Multiple Pass

17920

Cursor – Prepare

18176

Prepare SQL

18432

Exec Prepared SQL

18688

Unprepare

18944

Cursor – Execute

19200

Cursor – Recompile

19456

Cursor – Implicit Conversion

19712

Cursor – Unprepare

19968

Cursor – Close

20224

Missing Column Statistics

20480

Missing Join Predicate

20737

Server Memory Increase

20738

Server Memory Decrease

20992

User-Configurable 0

21248

User-Configurable 1

21504

User-Configurable 2

21760

User-Configurable 3

22016

User-Configurable 4

22272

User-Configurable 5

22528

User-Configurable 6

22784

User-Configurable 7

23040

User-Configurable 8

23296

User-Configurable 9

23552

Data File Auto Grow

23808

Log File Auto Grow

24064

Data File Auto Shrink

24320

Log File Auto Shrink

24576

Showplan Text

24832

Showplan All

25088

Showplan Statistics Profile

25600

PRC Output Parameter

26113

Audit Database Scope GDR - Grant

26114

Audit Database Scope GDR – Revoke

26115

Audit Database Scope GDR – Deny

26369

Audit Schema Object GDR – Grant

26370

Audit Schema Object GDR – Revoke

26371

Audit Schema Object GDR – Deny

26625

Audit Add Login

26626

Audit Drop Login

26881

Audit Login GDR – Grant

26882

Audit Login GDR – Revoke

26883

Audit Login GDR – Deny

27137

Audit Login Change Default Database Property

27138

Audit Login Change Default Language Property

27139

Audit Login Change Name Property

27140

Audit Login Change Credential Property

27141

Audit Login Change Policy Property

27142

Audit Login Change Expiration Property

27393

Audit Login Change Password – Self Changed

27394

Audit Login Change Password – Changed

27395

Audit Login Change Password – Self Reset

27396

Audit Login Change Password – Reset

27397

Audit Login Change Password – Unlocked

27398

Audit Login Change Password – Must Change

27649

Audit Add Login to Server Role

27650

Audit Drop Login from Server Role

27905

Audit Add DB User

27906

Audit Drop DB User

27907

Audit Grant Database Access to DB User

27908

Audit Remove Database Access from DB User

28161

Audit Add Member to DB Role

28162

Audit Drop Member from DB Role

28163

Audit Change Member in DB Role

28417

Audit Add Role

28418

Audit Drop Role

28672

Audit App Role Change Password

28928

Audit Statement Permissions

29184

Audit Schema Object Access

29441

Audit Backup

29442

Audit Restore

29443

Audit Backuplog

29696

Audit DBCC

29953

Audit Change Audit – Audit Started

29954

Audit Change Audit – Audit Stopped

29955

Audit Change Audit – C2 Mode ON

29956

Audit Change Audit – C2 Mode OFF

30209

Audit Create Object with Derived Permission

30210

Audit Alter Object Derived Permission

30211

Audit Drop Object Derived Permission

30212

Audit Dump Object Derived Permission

30219

Audit Load Object Derived Permission

30464

OLEDB Call – Starting

30465

OLEDB Call – Completed

30720

OLEDB QueryInterface – Starting

30721

OLEDB QueryInterface – Completed

30976

OLEDB DataRead – Starting

30977

OLEDB DataRead - Completed

31232

Showplan XML

31488

SQL: FullTextQuery

31745

Broker: Conversation – Send Message

31746

Broker: Conversation – End Conversation

31747

Broker: Conversation – End Conversation with Error

31748

Broker: Conversation – Broker Initiated Error

31749

Broker: Conversation – Terminate Dialog

31750

Broker: Conversation – Received Sequenced Message

31751

Broker: Conversation – Received End Conversation

31752

Broker: Conversation – Received End Conversation with Error

31753

Broker: Conversation – Received Broker Error Message

31754

Broker: Conversation – Received End Conversation Ack

31755

Broker: Conversation – Begin Dialog

31756

Broker: Conversation – Dialog Created

31757

Broker: Conversation – End Conversation with Cleanup

32000

Deprecation Announcement

32256

Deprecation Final Support

32513

Exchange Spill – Begin

32514

Exchange Spill – End

32769

Audit Create Database

32770

Audit Alter Database

32771

Audit Drop Database

32772

Audit Dump Database

33025

Audit Create Database Object

33026

Audit Alter Database Object

33027

Audit Drop Database Object

33028

Audit Dump Database Object

33034

Audit Open Database Object

33035

Audit Load Database Object

33036

Audit Access Database Object

33281

Audit Create Database Principal

33282

Audit Alter Database Principal

33283

Audit Drop Database Principal

33284

Audit Dump Database Principal

33291

Audit Load Database Principal

33537

Audit Create Schema Object

33538

Audit Alter Schema Object

33539

Audit Drop Schema Object

33540

Audit Dump Schema Object

33544

Audit Transfer Schema Object

33547

Audit Load Schema Object

33792

Audit Server Principal Impersonation

34048

Audit Database Principal Impersonation

34304

Audit Server Object Take Ownership

34560

Audit Database Object Take Ownership

34817

Broker: Conversation Group – Create

34818

Broker: Conversation Group – Drop

35072

Blocked Process Report

35329

Broker: Connection – Connecting

35330

Broker: Connection – Connected

35331

Broker: Connection – Connect Failed

35332

Broker: Connection – Closing

35333

Broker: Connection – Closed

35334

Broker: Connection – Accept

35335

Broker: Connection – Send IO Error

35336

Broker: Connection – Receive IO Error

35584

Broker: Forwarded Message Sent

35840

Broker: Forwarded Message Dropped

36097

Broker: Message Classify – Local

36098

Broker: Message Classify – Remote

36099

Broker: Message Classify – Delayed

36352

Broker: Transmission

36608

Broker: Queue Disabled

36864

Broker: Mirrored Route State Changed

37376

Showplan XML Statistics Profile

37888

Deadlock Graph

38145

Broker: Remote Message Ack – Message with Acknowledgment Sent

38146

Broker: Remote Message Ack – Acknowledgment Sent

38147

Broker: Remote Message Ack – Message with Acknowledgment Received

38148

Broker: Remote Message Ack – Acknowledgment Received

38400

Trace File Close

38656

Database Mirroring Connection

38912

Audit Change Database Owner

39168

Audit Schema Object Take Ownership

39425

Audit Database Mirroring Login – Login Success

39426

Audit Database Mirroring Login – Login Protocol Error

39427

Audit Database Mirroring Login – Message Format Error

39428

Audit Database Mirroring Login – Negotiate Failure

39429

Audit Database Mirroring Login – Authentication Failure

39340

Audit Database Mirroring Login – Authorization Failure

39680

FT: Crawl Started

39936

FT: Crawl Stopped

40192

FT: Crawl Aborted

40449

Audit Broker Conversation – No Security Header

40450

Audit Broker Conversation – No Certificate

40451

Audit Broker Conversation – Invalid Signature

40452

Audit Broker Conversation – Run as Target Failure

40705

Audit Broker Login – Login Success

40706

Audit Broker Login – Login Protocol Error

40707

Audit Broker Login – Message Format Error

40708

Audit Broker Login – Negotiate Failure

40709

Audit Broker Login – Authentication Failure

40710

Audit Broker Login – Authorization Failure

40961

Broker: Sequenced Message Undeliverable

40962

Broker: Unsequenced Messaged Undeliverable

41216

Broker: Corrupted Message

41472

User Error Message

41729

Broker: Activation – Start

41730

Broker: Activation – Ended

41731

Broker: Activation – Aborted

41984

Object: Altered – Begin

41985

Object: Altered – Commit

41986

Object: Altered – Rollback

42240

Performance Statistics – New Batch SQL Text

42241

Performance Statistics – Queries in Stored Procedures Compiled

42242

Performance Statistics – Queries in Ad Hoc Statement Compiled

42243

Performance Statistics – Cached Query Destroyed

42497

SQL: StmtRecompile – Schema Changed

42498

SQL: StmtRecompile – Statistics Changed

42499

SQL: StmtRecompile – Deferred Compile

42500

SQL: StmtRecompile – Set Option Changed

42501

SQL: StmtRecompile – Temp Table Changed

42502

SQL: StmtRecompile – Remote Rowset Changed

42503

SQL: StmtRecompile – Browse Permissions Changed

42504

SQL: StmtRecompile – Query Notification Environment Changed

42505

SQL: StmtRecompile – Partition View Changed

42506

SQL: StmtRecompile – Cursor Options Changed

42507

SQL: StmtRecompile – Options Requested

42752

Database Mirroring State Change

43008

Showplan XML for Query Compile

43264

Showplan All for Query Compile

43521

Audit Server Scope GDR – Grant

43522

Audit Server Scope GDR – Revoke

43523

Audit Server Scope GDR – Deny

43777

Audit Server Object GDR – Grant

43778

Audit Server Object GDR – Revoke

43779

Audit Server Object GDR – Deny

44033

Audit Database Object GDR – Grant

44034

Audit Database Object GDR – Revoke

44035

Audit Database Object GDR – Deny

44289

Audit Administrator Bulk Server Operations

44290

Audit Alter Server Setting

44291

Audit Alter Server Resources

44292

Audit Authenticate Server Operations

44293

Audit External Access Server Operations

44463

Audit Alter Server State Operations

44800

Audit Server Alter Trace

45057

Audit Create Server Object

45058

Audit Alter Server Object

45059

Audit Drop Server Object

45060

Audit Dump Server Object

45063

Audit Map Credential Login

45065

Audit Drop Credential Mapping

45067

Audit Load Server Object

45313

Audit Create Server Principal

45314

Audit Alter Server Principal

45315

Audit Drop Server Principal

45316

Audit Dump Server Principal

45317

Audit Disable Server Principal

45318

Audit Enable Server Principal

45323

Audit Load Server Principal

45569

Audit Database Operation – Checkpoint

45570

Audit Database Operation – Subscribe to Query Notification

46080

Audit Database Object Access

46336

TM: Begin Tran Starting

46592

TM: Begin Tran Completed

46848

TM: Promote Tran Starting

47104

TM: Promote Tran Completed

47361

TM: Commit Tran Starting – Commit

47362

TM: Commit Tran Starting – Commit and Begin

47617

TM: Commit Tran Completed – Commit

47618

TM: Commit Tran Completed – Commit and Begin

47873

TM: Rollback Tran Starting – Rollback

47874

TM: Rollback Tran Starting – Rollback and Begin

48129

TM: Rollback Tran Completed - Rollback

48130

TM: Rollback Tran Completed – Rollback and Begin

48384

Lock: Timeout (timeout > 0)

48641

Progress Report: Online Index Operation – Start

48642

Progress Report: Online Index Operation – Stage 1 Execution Begin

48643

Progress Report: Online Index Operation – Stage 1 Execution End

48644

Progress Report: Online Index Operation – Stage 2 Execution Begin

48645

Progress Report: Online Index Operation – Stage 2 Execution End

48646

Progress Report: Online Index Operation – Inserted Row Count

48947

Progress Report: Online Index Operation – Done

48896

TM: Save Tran Starting

49152

TM: Save Tran Completed

49409

Background Job Error – Failure with Error

49410

Background Job Error – Queue is Full

49411

Background Job Error – Returned Error

49664

OLEDB Provider Information

49921

Mount Tape Request

49922

Mount Tape Complete

49923

Mount Tape Cancel

50176

Assembly Load

50688

Xquery Static Type

50945

QN:Subscription Table – Subscription Registered

50946

QN:Subscription Table – Subscription Rewound

50947

QN:Subscription Table – Subscription Fired

50948

QN:Subscription Table – Firing Failed with Broker Error

50949

QN:Subscription Table – Firing Failed without Broker Error

50950

QN:Subscription Table – Broker Error Intercepted

50951

QN:Subscription Table – Subscription Deletion Attempt

50952

QN:Subscription Table – Subscription Deletion Failed

50953

QN:Subscription Table – Subscription Destroyed

51201

QN:Parameter Table – Table Created

51202

QN:Parameter Table – Table Drop Attempt

51203

QN:Parameter Table – Table Attempt Failed

51204

QN:Parameter Table – Table Dropped

51205

QN:Parameter Table – Table Pinned

51206

QN:Parameter Table – Table Unpinned

51207

QN:Parameter Table – Number of Users Incremented

51208

QN:Parameter Table – Number of Users Decremented

51209

QN:Parameter Table – LRU Counter Reset

51210

QN:Parameter Table – Cleanup Task Started

51211

QN:Parameter Table – Cleanup Task Finished

51457

QN:Template – Created

51458

QN:Template – Matched

51459

QN:Template – Dropped

51713

QN:Dynamics – Clock Run Started

51714

QN:Dynamics – Clock Run Finished

51715

QN:Dynamics – Master Cleanup Task Started

51716

QN:Dynamics – Master Cleanup Task Finished

51717

QN:Dynamics – Master Cleanup Task Skipped

54272

Bitmap Warning

54528

Database Suspect Data Page

54784

CPU Threshold Exceeded

55040

PreConnect: Completed

55296

PreConnect: Starting

55552

Plan Guide Successful

55808

Plan Guide Unsuccessful

The following SQL Data Level events are recorded to the ChangeAuditor for SQL Data Level event log when SQL Data level event logging is enabled. They are listed below in numeric order by Event ID.

600

Row Added to a Table

601

Row Updated in a Table

602

Row Removed from a Table

603

Table Added

604

Table Removed

605

Table Altered

606

Table Truncated

607

View Added

608

View Removed

609

View Altered

610

Procedure Added

611

Procedure Removed

612

Procedure Altered

613

Function Added

614

Function Removed

615

Function Altered

616

Index Added to a Table

617

Index Removed from a Table

618

Trigger Added

619

Trigger Removed

620

Trigger Altered

621

Rule Added

622

Rule Removed

623

Object Renamed

624

Primary Key Added to a Table

625

Primary Key Removed from a Table

626

Foreign Key Added to a Table

627

Foreign Key Removed from a Table

628

Default Object Added

629

Default Object Removed

630

Default Constraint Added to a Table

631

Default Constraint Removed from a Table

632

Check Constraint Added to a Table

633

Check Constraint Removed from a Table

634

Type Added

635

Type Removed

636

Statistics Added to a Table

637

Statistics Removed from a Table

638

User Added

639

User Removed

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating