Change Auditor for SQL Server 7.0.2 - User Guide

SQL Auditing wizard

The SQL Auditing wizard is displayed when you click Add or Edit on the SQL Auditing page. This wizard steps you through the process of creating a new template, identifying the SQL instances to be included in the template. You will also use this wizard to modify a previously defined template.

On the first page of the wizard, enter a name for the template and select the SQL instance to audit.

Template Name

Enter a descriptive name for the template being created.

Audit SQL Instance

Select one of the following options:

Default - This option is selected by default and will use the default SQL instance (MSSQLSERVER) found on an agent that is using the SQL Server Auditing template.
Named - Select this option to use a named instance instead of the default SQL instance. When this option is selected, the name field will be activated allowing you to enter a SQL named instance. Or use the browse button to the right of this field to select from a list of available servers. Selecting the browse button opens the Select a SQL Instance dialog which displays a list of available servers.
All Instances - Select this option to audit all SQL instances on a SQL server.

Add

Use to move the entry in the Audit SQL Instance text box to the selection list.

Remove

Select an entry in the selection list and click Remove to remove it from the template.

SQL Instance list

The list box, located across the bottom of this page, displays the SQL instances selected for auditing.

From this page, select the SQL Server operations (event classes) to audit on the selected SQL instance. You must select at least one operation.

Event Classes

The data grid across the top of the page displays all the SQL event classes available for auditing. Select/highlight an event class and use the appropriate add option to add either the individual event class or all events in the selected facility.

This grid displays the following information for each event class:

Facility - the facility to which each event class belongs
Event Class - the events available for auditing
Severity - the current severity level assigned to each event
Status - indicates whether the event is currently enabled or disabled
SQL2008 - indicates whether the event class is available in SQL 2008
SQL2008R2 - indicates whether the event class is available in SQL 2008 R2
SQL2012 - indicates whether the event class is available in SQL 2012

Add | Add This Event

Use to add the selected event class to the Audit list box at the bottom of the page.

Add | Add All Events in Facility

Use to add all event classes in the selected facility to the Audit list box at the bottom of the page.

Remove

Use to remove the selected entry from the Audit list box.

Selection list

This list box displays the facilities and/or event classes to be included in the selected auditing template.

Using the Select Column Filters page you can optionally define column filters to limit the data retrieved. These filters allow you to capture only the required information in high traffic databases.

Filters

The data grid across the top of the page displays the SQL columns available for filtering. Select/highlight an entry and then use the Filter where fields to define the operator and values to be used in the filter.

Filter where ...

In the first field (left) use the drop-down menu to select the operator (e.g., Like or Not Like; =, !=, <= or >=). The operators listed are based on the entry selected in the Filters list above.

In the second field (right) enter the value or string to be used in the filter.

For example, to limit the data retrieval to all databases that begin with ‘Change’ (e.g., Change Auditor, ChangeAuditor_Archive_2011, ChangeManager, etc.)

Select DatabaseName from the Filters list.
Select LIKE in the first field.
Enter Change% in the second field.
Click Add to add it to the list.
NOTE: To add multiple filters, select the column filter row after which the new filter is to be added, and then use the Filter where fields to specify the new criteria. By default, when multiple filters are specified these filters are ‘ANDed’ together and all filters must be met in order to be considered a match. To use the ‘OR’ operator instead, click in the left-most column of a column filter row and select OR from the drop-down. When filters are ‘ORed’ together, then only one of the filters must be met in order to be considered a match.

Add

Use to move the filter entered above to the Column Filter list at the bottom of the page.

Remove

Use to remove the selected entry from the Column Filter list.

Modify

Use to change the operator or value of the filter selected in the Column Filter list.

Column Filter list

This list box displays the column filters defined for this SQL Auditing template.

SQL Server event logging

In addition to real-time event auditing, you can enable event logging to capture SQL Server events locally in a Windows event log. This event log can then be collected using Quest InTrust to satisfy long-term storage requirements.

For SQL Server events, event logging is disabled by default. When enabled, only configured SQL server activities are sent to the Change Auditor for SQL event log. See the Change Auditor for SQL Event Reference Guide for a list of the events that can be sent to this event log.

2
Select Agent.
3
Click Event Logging and select SQL.
4
Click OK to save your selection and close the dialog.

SQL Data Level Auditing

Introduction

SQL Data Level auditing allows you to audit changes to databases and tables. Separate SQL Data Level auditing templates must be defined for each target database to be audited by Change Auditor.

The SQL Data Level Auditing page on the Administration Tasks tab displays details about each SQL Data level auditing template created and allows you to add, modify, and delete templates.

 

Ensure that you have reviewed the requirements that must be in place for SQL Data Level auditing. For more information, see Client components/features.

相关文档