Change Auditor for SQL Server 7.3 - Event Reference Guide

Introduction Change Auditor for SQL Server Events

SQL Broker Event SQL CLR Event SQL Cursors Event SQL Database Event SQL Deprecation Event SQL Errors and Warnings Event SQL Full Text Event SQL Locks Event SQL Objects Event SQL OLEDB Event SQL Performance Event SQL Progress Report Event SQL Query Notifications Event SQL Scan Event SQL Security Audit Event SQL Server Event SQL Session Event SQL Stored Procedures Event SQL Transactions Event SQL TSQL Event SQL User-Configurable Event SQL Data Level Event SQL Extended Events

Log Events

SQL Extended Events

The SQL Extended Events facility contains event classes that are used to monitor SQL data changes that are part of the Admin, Analytic, and Operational channels.

Table 23. SQL Extended Events Auditing events
Event	Description	Severity
SQL Server Admin Extended Event	Created when an SQL Extended Event occurs in the Admin channel.	High
SQL Server Analytic Extended Event	Created when an SQL Server Analytic Extended Event occurs in the Analytic channel.	Medium
SQL Server Operational Extended Event	Created when an SQL Server Operational Extended Event occurs in the Operational channel.	Medium

Log Events

When event logging for SQL is enabled in Change Auditor, SQL events will be written to a Windows event log, named ChangeAuditor for SQL. This event log can then be gathered by InTrust for further processing and reporting.


	NOTE: To enable event logging, select Event Logging on the Agent Configuration page (Administration Tasks tab), and select the type of event logging to be enabled.

ChangeAuditor for SQL event log

The following SQL events are recorded to the ChangeAuditor for SQL event log when SQL event logging is enabled. They are listed below in numeric order by Event ID.

Table 24. ChangeAuditor for SQL event log events
Event ID	Description
2560	RPC: Completed
2816	RPC: Starting
3072	SQL: BatchCompleted
3328	SQL: BatchStarting
3584	Audit Login
3840	Audit Logout
4096	Attention Event
4609	Audit Server Shutdown
4610	Audit Server Start
4611	Audit Server Pause
4612	Audit Server Resume
4864	DTCTransaction – Get Address
4865	DTCTransaction – Propagate Transaction
4867	DTCTransaction – Close Connection
4870	DTCTransaction – Creating a new DTC Transaction
4871	DTCTransaction – Enlisting in a DTC Transaction
4872	DTCTransaction – Internal Active
4873	DTCTransaction – Internal Commit
4874	DTCTransaction – Internal Abort
4878	DTCTransaction – Preparing Transaction
4879	DTCTransaction – Transaction is Prepared
4880	DTCTransaction – Transaction is Aborting
4881	DTCTransaction – Transaction is Committing
4886	DTCTransaction – TM Failed While in Prepared State
4887	DTCTransaction – Unknown
5120	Audit Login Failed
5376	Event Logged
5632	Error Logged
5888	Lock: Released
6144	Lock: Acquired
6400	Lock: Deadlock
6656	Lock: Cancel
6912	Lock: Timeout
7169	Degree of Parallelism – Select
7170	Degree of Parallelism – Insert
7171	Degree of Parallelism – Update
7172	Degree of Parallelism – Delete
8448	Exception
8704	SP:CacheMiss
8960	SP:CacheInsert
9217	SP:CacheRemove – Compplan Remove
9218	SP:CacheRemove – Proc Cache Flush
9473	SP:Recompile – Schema Changed
9474	SP:Recompile – Statistics Changed
9475	SP:Recompile – Recompile DNR
9476	SP:Recompile – Set Option Changed
9477	SP:Recompile – Temp Table Changed
9478	SP:Recompile – Remote Rowset Changed
9479	SP:Recompile – Browse Perms Changed
9480	SP:Recompile – Query Notification Environment Changed
9481	SP:Recompile – MPI View Changed
9482	SP:Recompile – Cursor Options Changed
9483	SP:Recompile – Recompile Option
9729	SP:CacheHit – Execution Context Hit
9730	SP:CacheHit – Compplan Hit
10240	SQL:StmtStarting
10496	SQL:StmtCompleted
10752	SP:Starting
11008	SP:Completed
11264	SP:StmtStarting
11520	SP:StmtCompleted
11776	Object: Created – Begin
11777	Object: Created – Commit
11778	Object: Created – Rollback
12032	Object: Deleted – Begin
12033	Object: Deleted – Commit
12034	Object: Deleted – Rollback
12800	SQL Transaction Begin
12801	SQL Transaction Commit
12802	SQL Transaction Rollback
12803	SQL Transaction Savepoint
13056	Scan: Started
13312	Scan: Stopped
13568	Cursor – Open
13824	TransactionLog
14080	Hash Warning – Recursion
14081	Hash Warning – Bailout
14849	Auto Stats - Sync
14850	Auto Stats – Async Queued
14851	Auto Stats – Async Starting
14852	Auto Stats – Async Completed
15205	Lock: Deadlock Chain – Resource Type Lock
15206	Lock: Deadlock Chain – Resource Type Exchange
15360	Lock: Escalation
15616	OLEDB Errors
17153	Execution Warnings – Query Wait
17154	Execution Warnings – Query Timeout
17408	Showplan – Text (Unencoded)
17665	Sort Warnings – Single Pass
17666	Sort Warnings – Multiple Pass
17920	Cursor – Prepare
18176	Prepare SQL
18432	Exec Prepared SQL
18688	Unprepare
18944	Cursor – Execute
19200	Cursor – Recompile
19456	Cursor – Implicit Conversion
19712	Cursor – Unprepare
19968	Cursor – Close
20224	Missing Column Statistics
20480	Missing Join Predicate
20737	Server Memory Increase
20738	Server Memory Decrease
20992	User-Configurable 0
21248	User-Configurable 1
21504	User-Configurable 2
21760	User-Configurable 3
22016	User-Configurable 4
22272	User-Configurable 5
22528	User-Configurable 6
22784	User-Configurable 7
23040	User-Configurable 8
23296	User-Configurable 9
23552	Data File Auto Grow
23808	Log File Auto Grow
24064	Data File Auto Shrink
24320	Log File Auto Shrink
24576	Showplan Text
24832	Showplan All
25088	Showplan Statistics Profile
25600	PRC Output Parameter
26113	Audit Database Scope GDR - Grant
26114	Audit Database Scope GDR – Revoke
26115	Audit Database Scope GDR – Deny
26369	Audit Schema Object GDR – Grant
26370	Audit Schema Object GDR – Revoke
26371	Audit Schema Object GDR – Deny
26625	Audit Add Login
26626	Audit Drop Login
26881	Audit Login GDR – Grant
26882	Audit Login GDR – Revoke
26883	Audit Login GDR – Deny
27137	Audit Login Change Default Database Property
27138	Audit Login Change Default Language Property
27139	Audit Login Change Name Property
27140	Audit Login Change Credential Property
27141	Audit Login Change Policy Property
27142	Audit Login Change Expiration Property
27393	Audit Login Change Password – Self Changed
27394	Audit Login Change Password – Changed
27395	Audit Login Change Password – Self Reset
27396	Audit Login Change Password – Reset
27397	Audit Login Change Password – Unlocked
27398	Audit Login Change Password – Must Change
27649	Audit Add Login to Server Role
27650	Audit Drop Login from Server Role
27905	Audit Add DB User
27906	Audit Drop DB User
27907	Audit Grant Database Access to DB User
27908	Audit Remove Database Access from DB User
28161	Audit Add Member to DB Role
28162	Audit Drop Member from DB Role
28163	Audit Change Member in DB Role
28417	Audit Add Role
28418	Audit Drop Role
28672	Audit App Role Change Password
28928	Audit Statement Permissions
29184	Audit Schema Object Access
29441	Audit Backup
29442	Audit Restore
29443	Audit Backuplog
29696	Audit DBCC
29953	Audit Change Audit – Audit Started
29954	Audit Change Audit – Audit Stopped
29955	Audit Change Audit – C2 Mode ON
29956	Audit Change Audit – C2 Mode OFF
30209	Audit Create Object with Derived Permission
30210	Audit Alter Object Derived Permission
30211	Audit Drop Object Derived Permission
30212	Audit Dump Object Derived Permission
30219	Audit Load Object Derived Permission
30464	OLEDB Call – Starting
30465	OLEDB Call – Completed
30720	OLEDB QueryInterface – Starting
30721	OLEDB QueryInterface – Completed
30976	OLEDB DataRead – Starting
30977	OLEDB DataRead - Completed
31232	Showplan XML
31488	SQL: FullTextQuery
31745	Broker: Conversation – Send Message
31746	Broker: Conversation – End Conversation
31747	Broker: Conversation – End Conversation with Error
31748	Broker: Conversation – Broker Initiated Error
31749	Broker: Conversation – Terminate Dialog
31750	Broker: Conversation – Received Sequenced Message
31751	Broker: Conversation – Received End Conversation
31752	Broker: Conversation – Received End Conversation with Error
31753	Broker: Conversation – Received Broker Error Message
31754	Broker: Conversation – Received End Conversation Ack
31755	Broker: Conversation – Begin Dialog
31756	Broker: Conversation – Dialog Created
31757	Broker: Conversation – End Conversation with Cleanup
32000	Deprecation Announcement
32256	Deprecation Final Support
32513	Exchange Spill – Begin
32514	Exchange Spill – End
32769	Audit Create Database
32770	Audit Alter Database
32771	Audit Drop Database
32772	Audit Dump Database
33025	Audit Create Database Object
33026	Audit Alter Database Object
33027	Audit Drop Database Object
33028	Audit Dump Database Object
33034	Audit Open Database Object
33035	Audit Load Database Object
33036	Audit Access Database Object
33281	Audit Create Database Principal
33282	Audit Alter Database Principal
33283	Audit Drop Database Principal
33284	Audit Dump Database Principal
33291	Audit Load Database Principal
33537	Audit Create Schema Object
33538	Audit Alter Schema Object
33539	Audit Drop Schema Object
33540	Audit Dump Schema Object
33544	Audit Transfer Schema Object
33547	Audit Load Schema Object
33792	Audit Server Principal Impersonation
34048	Audit Database Principal Impersonation
34304	Audit Server Object Take Ownership
34560	Audit Database Object Take Ownership
34817	Broker: Conversation Group – Create
34818	Broker: Conversation Group – Drop
35072	Blocked Process Report
35329	Broker: Connection – Connecting
35330	Broker: Connection – Connected
35331	Broker: Connection – Connect Failed
35332	Broker: Connection – Closing
35333	Broker: Connection – Closed
35334	Broker: Connection – Accept
35335	Broker: Connection – Send IO Error
35336	Broker: Connection – Receive IO Error
35584	Broker: Forwarded Message Sent
35840	Broker: Forwarded Message Dropped
36097	Broker: Message Classify – Local
36098	Broker: Message Classify – Remote
36099	Broker: Message Classify – Delayed
36352	Broker: Transmission
36608	Broker: Queue Disabled
36864	Broker: Mirrored Route State Changed
37376	Showplan XML Statistics Profile
37888	Deadlock Graph
38145	Broker: Remote Message Ack – Message with Acknowledgment Sent
38146	Broker: Remote Message Ack – Acknowledgment Sent
38147	Broker: Remote Message Ack – Message with Acknowledgment Received
38148	Broker: Remote Message Ack – Acknowledgment Received
38400	Trace File Close
38656	Database Mirroring Connection
38912	Audit Change Database Owner
39168	Audit Schema Object Take Ownership
39425	Audit Database Mirroring Login – Login Success
39426	Audit Database Mirroring Login – Login Protocol Error
39427	Audit Database Mirroring Login – Message Format Error
39428	Audit Database Mirroring Login – Negotiate Failure
39429	Audit Database Mirroring Login – Authentication Failure
39340	Audit Database Mirroring Login – Authorization Failure
39680	FT: Crawl Started
39936	FT: Crawl Stopped
40192	FT: Crawl Aborted
40449	Audit Broker Conversation – No Security Header
40450	Audit Broker Conversation – No Certificate
40451	Audit Broker Conversation – Invalid Signature
40452	Audit Broker Conversation – Run as Target Failure
40705	Audit Broker Login – Login Success
40706	Audit Broker Login – Login Protocol Error
40707	Audit Broker Login – Message Format Error
40708	Audit Broker Login – Negotiate Failure
40709	Audit Broker Login – Authentication Failure
40710	Audit Broker Login – Authorization Failure
40961	Broker: Sequenced Message Undeliverable
40962	Broker: Unsequenced Messaged Undeliverable
41216	Broker: Corrupted Message
41472	User Error Message
41729	Broker: Activation – Start
41730	Broker: Activation – Ended
41731	Broker: Activation – Aborted
41984	Object: Altered – Begin
41985	Object: Altered – Commit
41986	Object: Altered – Rollback
42240	Performance Statistics – New Batch SQL Text
42241	Performance Statistics – Queries in Stored Procedures Compiled
42242	Performance Statistics – Queries in Ad Hoc Statement Compiled
42243	Performance Statistics – Cached Query Destroyed
42497	SQL: StmtRecompile – Schema Changed
42498	SQL: StmtRecompile – Statistics Changed
42499	SQL: StmtRecompile – Deferred Compile
42500	SQL: StmtRecompile – Set Option Changed
42501	SQL: StmtRecompile – Temp Table Changed
42502	SQL: StmtRecompile – Remote Rowset Changed
42503	SQL: StmtRecompile – Browse Permissions Changed
42504	SQL: StmtRecompile – Query Notification Environment Changed
42505	SQL: StmtRecompile – Partition View Changed
42506	SQL: StmtRecompile – Cursor Options Changed
42507	SQL: StmtRecompile – Options Requested
42752	Database Mirroring State Change
43008	Showplan XML for Query Compile
43264	Showplan All for Query Compile
43521	Audit Server Scope GDR – Grant
43522	Audit Server Scope GDR – Revoke
43523	Audit Server Scope GDR – Deny
43777	Audit Server Object GDR – Grant
43778	Audit Server Object GDR – Revoke
43779	Audit Server Object GDR – Deny
44033	Audit Database Object GDR – Grant
44034	Audit Database Object GDR – Revoke
44035	Audit Database Object GDR – Deny
44289	Audit Administrator Bulk Server Operations
44290	Audit Alter Server Setting
44291	Audit Alter Server Resources
44292	Audit Authenticate Server Operations
44293	Audit External Access Server Operations
44463	Audit Alter Server State Operations
44800	Audit Server Alter Trace
45057	Audit Create Server Object
45058	Audit Alter Server Object
45059	Audit Drop Server Object
45060	Audit Dump Server Object
45063	Audit Map Credential Login
45065	Audit Drop Credential Mapping
45067	Audit Load Server Object
45313	Audit Create Server Principal
45314	Audit Alter Server Principal
45315	Audit Drop Server Principal
45316	Audit Dump Server Principal
45317	Audit Disable Server Principal
45318	Audit Enable Server Principal
45323	Audit Load Server Principal
45569	Audit Database Operation – Checkpoint
45570	Audit Database Operation – Subscribe to Query Notification
46080	Audit Database Object Access
46336	TM: Begin Tran Starting
46592	TM: Begin Tran Completed
46848	TM: Promote Tran Starting
47104	TM: Promote Tran Completed
47361	TM: Commit Tran Starting – Commit
47362	TM: Commit Tran Starting – Commit and Begin
47617	TM: Commit Tran Completed – Commit
47618	TM: Commit Tran Completed – Commit and Begin
47873	TM: Rollback Tran Starting – Rollback
47874	TM: Rollback Tran Starting – Rollback and Begin
48129	TM: Rollback Tran Completed - Rollback
48130	TM: Rollback Tran Completed – Rollback and Begin
48384	Lock: Timeout (timeout > 0)
48641	Progress Report: Online Index Operation – Start
48642	Progress Report: Online Index Operation – Stage 1 Execution Begin
48643	Progress Report: Online Index Operation – Stage 1 Execution End
48644	Progress Report: Online Index Operation – Stage 2 Execution Begin
48645	Progress Report: Online Index Operation – Stage 2 Execution End
48646	Progress Report: Online Index Operation – Inserted Row Count
48947	Progress Report: Online Index Operation – Done
48896	TM: Save Tran Starting
49152	TM: Save Tran Completed
49409	Background Job Error – Failure with Error
49410	Background Job Error – Queue is Full
49411	Background Job Error – Returned Error
49664	OLEDB Provider Information
49921	Mount Tape Request
49922	Mount Tape Complete
49923	Mount Tape Cancel
50176	Assembly Load
50688	Xquery Static Type
50945	QN:Subscription Table – Subscription Registered
50946	QN:Subscription Table – Subscription Rewound
50947	QN:Subscription Table – Subscription Fired
50948	QN:Subscription Table – Firing Failed with Broker Error
50949	QN:Subscription Table – Firing Failed without Broker Error
50950	QN:Subscription Table – Broker Error Intercepted
50951	QN:Subscription Table – Subscription Deletion Attempt
50952	QN:Subscription Table – Subscription Deletion Failed
50953	QN:Subscription Table – Subscription Destroyed
51201	QN:Parameter Table – Table Created
51202	QN:Parameter Table – Table Drop Attempt
51203	QN:Parameter Table – Table Attempt Failed
51204	QN:Parameter Table – Table Dropped
51205	QN:Parameter Table – Table Pinned
51206	QN:Parameter Table – Table Unpinned
51207	QN:Parameter Table – Number of Users Incremented
51208	QN:Parameter Table – Number of Users Decremented
51209	QN:Parameter Table – LRU Counter Reset
51210	QN:Parameter Table – Cleanup Task Started
51211	QN:Parameter Table – Cleanup Task Finished
51457	QN:Template – Created
51458	QN:Template – Matched
51459	QN:Template – Dropped
51713	QN:Dynamics – Clock Run Started
51714	QN:Dynamics – Clock Run Finished
51715	QN:Dynamics – Master Cleanup Task Started
51716	QN:Dynamics – Master Cleanup Task Finished
51717	QN:Dynamics – Master Cleanup Task Skipped
54272	Bitmap Warning
54528	Database Suspect Data Page
54784	CPU Threshold Exceeded
55040	PreConnect: Completed
55296	PreConnect: Starting
55552	Plan Guide Successful
55808	Plan Guide Unsuccessful

ChangeAuditor for SQL Data Level event log

The following SQL Data Level events are recorded to the ChangeAuditor for SQL Data Level event log when SQL Data level event logging is enabled. They are listed below in numeric order by Event ID.

Table 25. ChangeAuditor for SQL event log events
Event ID	Description
600	Row Added to a Table
601	Row Updated in a Table
602	Row Removed from a Table
603	Table Added
604	Table Removed
605	Table Altered
606	Table Truncated
607	View Added
608	View Removed
609	View Altered
610	Procedure Added
611	Procedure Removed
612	Procedure Altered
613	Function Added
614	Function Removed
615	Function Altered
616	Index Added to a Table
617	Index Removed from a Table
618	Trigger Added
619	Trigger Removed
620	Trigger Altered
621	Rule Added
622	Rule Removed
623	Object Renamed
624	Primary Key Added to a Table
625	Primary Key Removed from a Table
626	Foreign Key Added to a Table
627	Foreign Key Removed from a Table
628	Default Object Added
629	Default Object Removed
630	Default Constraint Added to a Table
631	Default Constraint Removed from a Table
632	Check Constraint Added to a Table
633	Check Constraint Removed from a Table
634	Type Added
635	Type Removed
636	Statistics Added to a Table
637	Statistics Removed from a Table
638	User Added
639	User Removed

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor for SQL Server 7.3 - Event Reference Guide

SQL Extended Events

Log Events