Chat now with support
Chat with Support

Change Auditor for SQL Server 7.2 - Event Reference Guide

Introduction

Change Auditor for SQL Server provides database auditing to secure SQL database assets with extensive, customizable auditing and reporting for critical SQL changes including broker, database, object, performance, transaction events, errors and warnings, and data changes. SQL auditing helps tighten enterprise-wide change and control policies by tracking user and administrator activity such as database additions and deletions, granting and removing SQL access, and so on.

To enable SQL Server auditing in Change Auditor, you must assign a SQL Auditing template to Change Auditor agents. Change Auditor for SQL Server ships with a predefined SQL Auditing template that you can use to audit key events on the default SQL Server instance or you can create a SQL auditing template to specify the SQL instances and SQL Server operations to audit.

In addition to real-time auditing, you can also enable event logging to capture SQL Server events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

This guide lists the events that are captured by Change Auditor for SQL Server. Separate event reference guides are available that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for SQL Server Events

This section lists the audited events specific to Change Auditor for SQL Server. It also lists each event’s corresponding severity setting. Audited events are listed in alphabetical order by facility:

 

SQL Broker Event

The SQL Broker Event facility includes event classes that are produced by the Service Broker.

Broker: Activation - Aborted

Created when a SQL Server activation stored procedure is aborted.

Medium

Broker: Activation – Ended

Created when a SQL Server activation stored procedure is ended.

Medium

Broker: Activation - Start

Created when SQL Server activation stored procedure is started.

Medium

Broker: Connection – Accept

Created when SQL Server has accepted a transport connection from another instance.

Medium

Broker: Connection – Closed

Created when a SQL Server has closed the transport connection.

Medium

Broker: Connection - Closing

Created when a SQL Server is closing the transport connection.

Medium

Broker: Connection – Connect Failed

Created when a SQL Server fails to establish a transport connection.

Medium

Broker: Connection – Connected

Created when a SQL Server has established a transport connection.

Medium

Broker: Connection - Connecting

Created when a SQL Server is initiating a transport connection.

Medium

Broker: Connection – Receive IO Error

Created when a SQL Server encounters a transport error while receiving a message.

Medium

Broker: Connection – Send IO Error

Created when a SQL Server encounters a transport error while sending a message.

Medium

Broker: Conversation – Begin Dialog

Created when the Database Engine executes a Begin Dialog command.

Medium

Broker: Conversation – Broker Initiated Error

Created when the Service Broker creates an error message.

Medium

Broker: Conversation – Dialog Created

Created when the Service Broker creates an endpoint for a dialog.

Medium

Broker: Conversation – End Conversation

Created when the Database Engine executes an END CONVERSATION statement that does not include the WITH ERROR clause.

Medium

Broker: Conversation – End Conversation with Cleanup

Created when the Database Engine executes an END CONVERSATION statement that includes the WITH CLEANUP CLAUSE.

Medium

Broker: Conversation – End Conversation with Error

Created when the Database Engine executes an END CONVERSATION statement that includes the WITH ERROR clause.

Medium

Broker: Conversation – Received Broker Error Message

Created when the Service Broker receives a broker-defined error message from the other side of the conversation.

Medium

Broker: Conversation – Received End Conversation

Created when SQL Server receives an End Dialog message from the other side of the conversation.

Medium

Broker: Conversation – Received End Conversation Ack

Created when the other side of a conversation acknowledged an End Dialog or Error message sent by this side of the conversation.

Medium

Broker: Conversation – Received End Conversation with Error

Created when SQL Server receives a user-defined error from the other side of the conversation.

Medium

Broker: Conversation – Received Sequenced Message

Created when SQL Server receives a message that contains a message sequence number.

Medium

Broker: Conversation – Send Message

Created when the Database Engine executes a SEND statement.

Medium

Broker: Conversation – Terminate Dialog

Created when the Service Broker terminates the dialog.

Medium

Broker: Conversation Group – Create

Created when SQL Server creates a new conversation group.

Medium

Broker: Conversation Group – Drop

Created when SQL Server deletes a conversation group.

Medium

Broker: Corrupted Message

Created when the Service Broker receives a corrupted message.

Medium

Broker: Forwarded Message Dropped

Created when the Service Broker drops a message that was intended to be forwarded.

Medium

Broker: Forwarded Message Sent

Created when the Service Broker forwards a message.

Medium

Broker: Message Classify – Delayed

Created when the Service Broker delayed the routing for a message. (Disabled by default)

Medium

Broker: Message Classify - Local

Created when the Service Broker determines the routing for a local message.

Medium

Broker: Message Classify – Remote

Created when the Service Broker determines the routing for a remote message.

Medium

Broker: Mirrored Route State Changed

Created when the mirrored route state changes on the Service Broker.

Medium

Broker: Queue Disabled

Created when a poison message is detected because there are five consecutive transaction rollbacks on a Service Broker queue.

Medium

Broker: Remote Message Ack – Acknowledgment Received

Created when the Service Broker receives an acknowledgment outside of a normal sequenced message

Medium

Broker: Remote Message Ack - Acknowledgment Sent

Created when the Service Broker sends an acknowledgment outside of a normal sequenced message.

Medium

Broker: Remote Message Ack – Message with Acknowledgment Received

Created when the Service Broker receives an acknowledgment as part of a normal sequenced message.

Medium

Broker: Remote Message Ack – Message with Acknowledgment Sent

Created when the Service Broker sends an acknowledgment as part of a normal sequenced message.

Medium

Broker: Sequenced Message Undeliverable

Created when the Service Broker is unable to retain a received sequenced message that should have been delivered to a service.

Medium

Broker: Transmission

Created when an error has occurred in the Service Broker transport layer.

Medium

Broker: Unsequenced Message Undeliverable

Create when the Service Broker is unable to retain a received unsequenced message that should have been delivered to a service.

Medium

SQL CLR Event

The SQL CLR Event facility includes event classes that are produced by the execution of .NET Common Language Runtime (CLR) objects inside SQL Server.

Table 2. SQL CLR event

Assembly Load

Created when a request to load the assembly results in an error.

Medium

Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating