Chat now with support
Chat with Support

Change Auditor for SQL Server 7.3 - User Guide

Change Auditor for SQL Server Overview

•
Introduction
•
Deployment requirements
•
Client components/features

Introduction

Change Auditor for SQL Server provides database auditing to secure SQL database assets with extensive, customizable auditing and reporting for all critical SQL Server changes including broker, database, object, performance, transaction events, changes to databases and tables, plus errors and warnings. SQL auditing helps tighten enterprise-wide change and control policies by tracking user and administrator activity such as database additions and deletions, granting and removing SQL access, and so on.

To enable SQL Server auditing, you must assign templates to the Change Auditor agents which define the SQL instances and event classes to audit; SQL Data Level auditing is assigned to a single agent when a template is created.

To enable SQL Extended Events auditing (preview feature), you must define a SQL Extended Events auditing template for each target SQL Server instance to be audited by Change Auditor.

This guide has been prepared to assist you in becoming familiar with Change Auditor for SQL Server. It is intended for network administrators, consultants, analysts, and any other IT professionals using the product.

•
For information on the core functionality available in Change Auditor regardless of the product license that has been applied, see the Change Auditor User Guide and the Change Auditor Installation Guide.
•
For event details, see the Change Auditor for SQL Server Event Reference Guide.

Deployment requirements

For a successful deployment, ensure that your environment meets the minimum system requirements. For information about system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide. For information about Change Auditor core functionality, see the Change Auditor User Guide.

Client components/features

The following table lists the client components and features that require a valid Change Auditor for SQL Server license.

* 
NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), select Action | Hide Unlicensed Components. Note that this command is only available when the Administration Tasks tab is the active page.
 
Table 1. Change Auditor for SQL Server client components/features
Client page
Feature

Administration Tasks tab

Agent Configuration page

•
Event Logging - enable/disable SQL Server event logging

Audit Task list:

•
SQL Server
NOTE: See SQL Server Auditing, and SQL Data Level Auditing for information about creating templates.

Events

Facilities:

•
Admin Extended Events
•
Analytic Extended Events
•
Operational Extended Events
•
SQL Broker Event
•
SQL CLR Event
•
SQL Cursors Event
•
SQL Database Event
•
SQL Data Level
•
SQL Deprecation Event
•
SQL Errors and Warnings Event
•
SQL Full Text Event
•
SQL Locks Event
•
SQL Objects Event
•
SQL OLEDB Event
•
SQL Performance Event
•
SQL Progress Report Event
•
SQL Query Notifications Event
•
SQL Scan Event
•
SQL Security Audit Event
•
SQL Server Event
•
SQL Session Event
•
SQL Stored Procedures Event
•
SQL Transactions Event
•
SQL TSQL Event
•
SQL User-Configurable Event

Search Properties

What tab

•
Subsystem | SQL
NOTE: See SQL Searches/Reports for information about using the What tab to create custom SQL search queries.

Searches page

Built-in reports:

•
All reports that include the events in the facilities listed above.

Advanced tab/Search Results page

NOTE: The data gathered will be dependent on whether you are auditing SQL, SQL Data Level Auditing, or SQL Extended Events.

Columns:

•
SQL Application Name
•
SQL Category
•
SQL Changed Columns
•
SQL Client Process ID
•
SQL Database ID
•
SQL Database Name
•
SQL Event Class
•
SQL Event Name
•
SQL Event SubClass
•
SQL Host Name
•
SQL Instance Name
•
SQL IsSystem
•
SQL Linked Server Name
•
SQL Object ID
•
SQL Object ID2
•
SQL Object Name
•
SQL Object Type
•
SQL Owner ID
•
SQL Owner Name
•
SQL Package Name
•
SQL Parent Name
•
SQL Provider Name
•
SQL Row Counts
•
SQL Session Login Name
•
SQL SPID
•
SQL Success
•
SQL Table Name
•
SQL Text Data
•
SQL Transaction ID

Alert Body Configuration dialog - Event Details tab

Variables (email tags):

•
SQL_APPLICATIONNAME
•
SQL_CLIENTPROCESSID
•
SQL_DATABASEID
•
SQL_DATABASENAME
•
SQL_EVENTCLASS
•
SQL_EVENTSUBCLASS
•
SQL_HOSTNAME
•
SQL_INSTANCENAME
•
SQL_ISSYSTEM
•
SQL_LINKEDSERVERNAME
•
SQL_OBJECTID
•
SQL_OBJECTID2
•
SQL_OBJECTNAME
•
SQL_OBJECTTYPE
•
SQL_OWNERID
•
SQL_OWNERNAME
•
SQL_PARENTNAME
•
SQL_PROVIDERNAME
•
SQL_ROWCOUNTS
•
SQL_SESSIONLOGINNAME
•
SQL_SPID
•
SQL_SUCCESS
•
TEXTDATA
NOTE: See the Change Auditor User Guide for a description of these email tags and how to configure alert email notifications.
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating