Change Auditor for SQL Server 7.1.1

SQL Auditing wizard

The SQL Auditing wizard is displayed when you click Add or Edit on the SQL Auditing page. This wizard steps you through the process of creating a new template, identifying the SQL instances to be included in the template. You will also use this wizard to modify a previously defined template.


	NOTE: A red flashing icon indicates that you have not yet entered the required information. Hovering your cursor over this icon displays a tool tip explaining what needs to be entered.

Table 2. SQL Auditing wizard fields and controls

Create or modify a SQL Auditing Template page

On the first page of the wizard, enter a name for the template and select the SQL instance to audit.

Template Name

Enter a descriptive name for the template being created.

Audit SQL Instance

Select one of the following options:

•

Default - This option is selected by default and will use the default SQL instance (MSSQLSERVER) found on an agent that is using the SQL Server Auditing template.

•

Named - Select this option to use a named instance instead of the default SQL instance. When this option is selected, the name field will be activated allowing you to enter a SQL named instance. Or use the browse button to the right of this field to select from a list of available servers. Selecting the browse button opens the Select a SQL Instance dialog which displays a list of available servers.

•

All Instances - Select this option to audit all SQL instances on a SQL server.

Add

Use to move the entry in the Audit SQL Instance text box to the selection list.

NOTE: Even if you select the Default SQL instance or All Instances, you must click Add to include it in the SQL Instance list.

Remove

Select an entry in the selection list and click Remove to remove it from the template.

SQL Instance list

The list box, located across the bottom of this page, displays the SQL instances selected for auditing.

NOTE: If you add a new named instance to the SQL instance list and want to use the same operations and filters that were previously defined for a SQL instance that is already in the list, simply click on the ‘old’ SQL instance and drag it onto the ‘new’ entry.

Select the changes in the SQL instance(s) to audit page

From this page, select the SQL Server operations (event classes) to audit on the selected SQL instance. You must select at least one operation.

Event Classes

The data grid across the top of the page displays all the SQL event classes available for auditing. Select/highlight an event class and use the appropriate add option to add either the individual event class or all events in the selected facility.

This grid displays the following information for each event class:

•

Facility - the facility to which each event class belongs

•

Event Class - the events available for auditing

•

Severity - the current severity level assigned to each event

•

Status - indicates whether the event is currently enabled or disabled

Add | Add This Event

Use to add the selected event class to the Audit list box at the bottom of the page.

Add | Add All Events in Facility

Use to add all event classes in the selected facility to the Audit list box at the bottom of the page.

Remove

Use to remove the selected entry from the Audit list box.

Selection list

This list box displays the facilities and/or event classes to be included in the selected auditing template.

(Optional) Select column filters page

Using the Select Column Filters page you can optionally define column filters to limit the data retrieved. These filters allow you to capture only the required information in high traffic databases.

Filters

The data grid across the top of the page displays the SQL columns available for filtering. Select/highlight an entry and then use the Filter where fields to define the operator and values to be used in the filter.

Filter where ...

In the first field (left) use the drop-down menu to select the operator (e.g., Like or Not Like; =, !=, <= or >=). The operators listed are based on the entry selected in the Filters list above.

In the second field (right) enter the value or string to be used in the filter.

NOTE: Valid wildcard characters that can be used in LIKE expressions for non-exact string matches include:

•

Asterisk (*) to match zero or more characters

•

Percent sign (%) to match zero or more characters

•

Underscore (_) to match a single character

For example, to limit the data retrieval to all databases that begin with ‘Change’ (e.g., Change Auditor, ChangeAuditor_Archive_2011, ChangeManager, etc.)

•

Select DatabaseName from the Filters list.

•

Select LIKE in the first field.

•

Enter Change% in the second field.

•

Click Add to add it to the list.

NOTE: To add multiple filters, select the column filter row after which the new filter is to be added, and then use the Filter where fields to specify the new criteria. By default, when multiple filters are specified these filters are ‘ANDed’ together and all filters must be met in order to be considered a match. To use the ‘OR’ operator instead, click in the left-most column of a column filter row and select OR from the drop-down. When filters are ‘ORed’ together, then only one of the filters must be met in order to be considered a match.

NOTE: When both ‘AND’ and ‘OR’ operators are present in the filter list, ‘ORed’ filters are evaluated first and their results are used by the ‘AND’ filter.

Add

Use to move the filter entered above to the Column Filter list at the bottom of the page.

Remove

Use to remove the selected entry from the Column Filter list.

Modify

Use to change the operator or value of the filter selected in the Column Filter list.

Column Filter list

This list box displays the column filters defined for this SQL Auditing template.