Change Auditor for SQL Server 7.2 - Event Reference Guide

Introduction Change Auditor for SQL Server Events

SQL Broker Event SQL CLR Event SQL Cursors Event SQL Database Event SQL Deprecation Event SQL Errors and Warnings Event SQL Full Text Event SQL Locks Event SQL Objects Event SQL OLEDB Event SQL Performance Event SQL Progress Report Event SQL Query Notifications Event SQL Scan Event SQL Security Audit Event SQL Server Event SQL Session Event SQL Stored Procedures Event SQL Transactions Event SQL TSQL Event SQL User-Configurable Event SQL Data Level Event

Log Events

Introduction

Change Auditor for SQL Server provides database auditing to secure SQL database assets with extensive, customizable auditing and reporting for critical SQL changes including broker, database, object, performance, transaction events, errors and warnings, and data changes. SQL auditing helps tighten enterprise-wide change and control policies by tracking user and administrator activity such as database additions and deletions, granting and removing SQL access, and so on.

To enable SQL Server auditing in Change Auditor, you must assign a SQL Auditing template to Change Auditor agents. Change Auditor for SQL Server ships with a predefined SQL Auditing template that you can use to audit key events on the default SQL Server instance or you can create a SQL auditing template to specify the SQL instances and SQL Server operations to audit.

In addition to real-time auditing, you can also enable event logging to capture SQL Server events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.


	NOTE: SQL Server auditing and event logging are only available when you have licensed Change Auditor for SQL Server and assigned a SQL Auditing template to your agents. Contact your Sales Representative for more information about obtaining Change Auditor for SQL Server.

This guide lists the events that are captured by Change Auditor for SQL Server. Separate event reference guides are available that list the core Change Auditor events (when any Change Auditor license is applied) and the events captured when the different auditing modules are licensed.

Change Auditor for SQL Server Events

This section lists the audited events specific to Change Auditor for SQL Server. It also lists each event’s corresponding severity setting. Audited events are listed in alphabetical order by facility:

•

•

•

•

•

SQL Deprecation Event

•

SQL Errors and Warnings Event

•

•

•

•

•

SQL Performance Event

•

SQL Progress Report Event

•

SQL Query Notifications Event

•

SQL Scan Event

•

SQL Security Audit Event

•

SQL Server Event

•

SQL Session Event

•

SQL Stored Procedures Event

•

SQL Transactions Event

•

SQL TSQL Event

•

SQL User-Configurable Event

•

SQL Data Level Event


	IMPORTANT: When expecting large numbers of events, it may be necessary to increase the Max Events per Connection setting in the client (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.


	NOTE: To view a complete list of all the events, open the Audit Events page on the Administration Tasks tab in the client. This page displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of license that is required to capture each event.

SQL Broker Event

The SQL Broker Event facility includes event classes that are produced by the Service Broker.

Table 1. SQL Broker events
Event	Description	Severity
Broker: Activation - Aborted	Created when a SQL Server activation stored procedure is aborted.	Medium
Broker: Activation – Ended	Created when a SQL Server activation stored procedure is ended.	Medium
Broker: Activation - Start	Created when SQL Server activation stored procedure is started.	Medium
Broker: Connection – Accept	Created when SQL Server has accepted a transport connection from another instance.	Medium
Broker: Connection – Closed	Created when a SQL Server has closed the transport connection.	Medium
Broker: Connection - Closing	Created when a SQL Server is closing the transport connection.	Medium
Broker: Connection – Connect Failed	Created when a SQL Server fails to establish a transport connection.	Medium
Broker: Connection – Connected	Created when a SQL Server has established a transport connection.	Medium
Broker: Connection - Connecting	Created when a SQL Server is initiating a transport connection.	Medium
Broker: Connection – Receive IO Error	Created when a SQL Server encounters a transport error while receiving a message.	Medium
Broker: Connection – Send IO Error	Created when a SQL Server encounters a transport error while sending a message.	Medium
Broker: Conversation – Begin Dialog	Created when the Database Engine executes a Begin Dialog command.	Medium
Broker: Conversation – Broker Initiated Error	Created when the Service Broker creates an error message.	Medium
Broker: Conversation – Dialog Created	Created when the Service Broker creates an endpoint for a dialog.	Medium
Broker: Conversation – End Conversation	Created when the Database Engine executes an END CONVERSATION statement that does not include the WITH ERROR clause.	Medium
Broker: Conversation – End Conversation with Cleanup	Created when the Database Engine executes an END CONVERSATION statement that includes the WITH CLEANUP CLAUSE.	Medium
Broker: Conversation – End Conversation with Error	Created when the Database Engine executes an END CONVERSATION statement that includes the WITH ERROR clause.	Medium
Broker: Conversation – Received Broker Error Message	Created when the Service Broker receives a broker-defined error message from the other side of the conversation.	Medium
Broker: Conversation – Received End Conversation	Created when SQL Server receives an End Dialog message from the other side of the conversation.	Medium
Broker: Conversation – Received End Conversation Ack	Created when the other side of a conversation acknowledged an End Dialog or Error message sent by this side of the conversation.	Medium
Broker: Conversation – Received End Conversation with Error	Created when SQL Server receives a user-defined error from the other side of the conversation.	Medium
Broker: Conversation – Received Sequenced Message	Created when SQL Server receives a message that contains a message sequence number.	Medium
Broker: Conversation – Send Message	Created when the Database Engine executes a SEND statement.	Medium
Broker: Conversation – Terminate Dialog	Created when the Service Broker terminates the dialog.	Medium
Broker: Conversation Group – Create	Created when SQL Server creates a new conversation group.	Medium
Broker: Conversation Group – Drop	Created when SQL Server deletes a conversation group.	Medium
Broker: Corrupted Message	Created when the Service Broker receives a corrupted message.	Medium
Broker: Forwarded Message Dropped	Created when the Service Broker drops a message that was intended to be forwarded.	Medium
Broker: Forwarded Message Sent	Created when the Service Broker forwards a message.	Medium
Broker: Message Classify – Delayed	Created when the Service Broker delayed the routing for a message. (Disabled by default)	Medium
Broker: Message Classify - Local	Created when the Service Broker determines the routing for a local message.	Medium
Broker: Message Classify – Remote	Created when the Service Broker determines the routing for a remote message.	Medium
Broker: Mirrored Route State Changed	Created when the mirrored route state changes on the Service Broker.	Medium
Broker: Queue Disabled	Created when a poison message is detected because there are five consecutive transaction rollbacks on a Service Broker queue.	Medium
Broker: Remote Message Ack – Acknowledgment Received	Created when the Service Broker receives an acknowledgment outside of a normal sequenced message	Medium
Broker: Remote Message Ack - Acknowledgment Sent	Created when the Service Broker sends an acknowledgment outside of a normal sequenced message.	Medium
Broker: Remote Message Ack – Message with Acknowledgment Received	Created when the Service Broker receives an acknowledgment as part of a normal sequenced message.	Medium
Broker: Remote Message Ack – Message with Acknowledgment Sent	Created when the Service Broker sends an acknowledgment as part of a normal sequenced message.	Medium
Broker: Sequenced Message Undeliverable	Created when the Service Broker is unable to retain a received sequenced message that should have been delivered to a service.	Medium
Broker: Transmission	Created when an error has occurred in the Service Broker transport layer.	Medium
Broker: Unsequenced Message Undeliverable	Create when the Service Broker is unable to retain a received unsequenced message that should have been delivered to a service.	Medium

SQL CLR Event

The SQL CLR Event facility includes event classes that are produced by the execution of .NET Common Language Runtime (CLR) objects inside SQL Server.

Table 2. SQL CLR event
Event	Description	Severity
Assembly Load	Created when a request to load the assembly results in an error.	Medium

Self Service Tools: Knowledge Base; Notifications & Alerts; Product Support; Software Downloads; Technical Documentation; User Forums; Video Tutorials; RSS Feed

Contact Us: Licensing Assistance; Technical Support; View All

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor for SQL Server 7.2 - Event Reference Guide

Introduction

Change Auditor for SQL Server Events

SQL Broker Event

SQL CLR Event