Change Auditor for SQL Server 7.3 - Event Reference Guide

Introduction Change Auditor for SQL Server Events

SQL Broker Event SQL CLR Event SQL Cursors Event SQL Database Event SQL Deprecation Event SQL Errors and Warnings Event SQL Full Text Event SQL Locks Event SQL Objects Event SQL OLEDB Event SQL Performance Event SQL Progress Report Event SQL Query Notifications Event SQL Scan Event SQL Security Audit Event SQL Server Event SQL Session Event SQL Stored Procedures Event SQL Transactions Event SQL TSQL Event SQL User-Configurable Event SQL Data Level Event SQL Extended Events

Log Events

SQL Security Audit Event

The SQL Security Audit Event facility contains security audit events.

Table 15. SQL Security Audit events
Event	Description	Severity
Audit Access Database Object	Created when the object is accessed.	Medium
Audit Add DB User	Created when the identified login is added as a database user.	Medium
Audit Add Login	Created when the identified SQL Server login is added to the server.	Medium
Audit Add Login to Server Role	Created when the identified login is added to the fixed server role.	Medium
Audit Add Member to DB Role	Created when the identified login is added to the database role.	Medium
Audit Add Role	Created when the database role is added to the database.	Medium
Audit Administer Bulk Server Operations	Created when a bulk server operation is administered.	Medium
Audit Alter Database	Created when the database is altered.	Medium
Audit Alter Database Object	Created when the object is altered.	Medium
Audit Alter Database Principal	Created when the Database Principle is altered.	Medium
Audit Alter Object Derived Permission	Created when an object with derived permissions is altered.	Medium
Audit Alter Schema Object	Created when a schema object is altered.	Medium
Audit Alter Server Object	Created when a server object is altered.	Medium
Audit Alter Server Principal	Created when a server principal object is altered.	Medium
Audit Alter Server Resources	Created when a server resource is altered.	Medium
Audit Alter Server Settings	Created when a server setting is altered.	Medium
Audit Alter Server State Operations	Created when a server state operation is altered.	Medium
Audit App Role Change Password	Created when a password is changed for the application role.	Medium
Audit Authenticate Server Operations	Created when an authenticate server operation is used.	Medium
Audit Backup	Created when a backup command is issued.	Medium
Audit Backuplog	Created when a backuplog command is issued.	Medium
Audit Broker Conversation - Invalid Signature	Created when the Service Broker could not verify the message signature supplied by the sender using the public key in the sender's certificate.	Medium
Audit Broker Conversation - No Certificate	Created when the Service Broker could not locate a usable certificate for one of the participants in the conversation.	Medium
Audit Broker Conversation - No Security Header	Created during a secure conversation when the Service Broker received a message that did not contain a session key.	Medium
Audit Broker Conversation - Run as Target Failure	Created when the destination user does not have receive permissions on the destination queue.	Medium
Audit Broker Login - Authentication Failure	Created when an Authentication Failure event reports that the Service Broker cannot perform authentication for the connection due to an error.	Medium
Audit Broker Login - Authorization Failure	Created when an Authorization Failure event reports that the Service Broker denied authorization for the connection.	Medium
Audit Broker Login - Login Protocol Error	Created when a Login Protocol Error event reports that the broker received a message that is well-formed but not valid for the current state of the login process.	Medium
Audit Broker Login - Login Success	Created when a Login Success event reports that the adjacent broker login process has finished successfully.	Medium
Audit Broker Login - Message Format Error	Created when a Message Format Error event reports that the broker received a message that does not match the expected format.	Medium
Audit Broker Login - Negotiate Failure	Created when a Negotiate Failure event reports that the local broker and the remote broker support mutually exclusive levels of authentication.	Medium
Audit Change Audit - Audit Started	Created when an audit trace is started. (Disabled by default)	Medium
Audit Change Audit - Audit Stopped	Created when an audit trace is stopped. (Disabled by default)	Medium
Audit Change Audit - C2 Mode OFF	Created when the C2 audit mode is turned OFF.	Medium
Audit Change Audit - C2 Mode ON	Created when the C2 audit mode is turned ON.	Medium
Audit Change Database Owner	Created when the ALTER AUTHORIZATION statement is used to change the owner of the database and the permissions required to do that are checked.	Medium
Audit Change Member in DB Role	Created when the database role has changed for the identified database login.	Medium
Audit Create Database	Created when the database is created.	Medium
Audit Create Database Object	Created when the object is created.	Medium
Audit Create Database Principal	Created when the Database Principle is created.	Medium
Audit Create Object with Derived Permission	Created when an object with derived permissions is created. (Disabled by default)	Medium
Audit Create Schema Object	Created when a schema object is created.	Medium
Audit Create Server Object	Created when a server object is created.	Medium
Audit Create Server Principal	Created when a server principal object is created.	Medium
Audit Database Mirroring Login - Authentication Failure	Created when an Authentication Failure event reports that a database mirroring endpoint cannot perform authentication for the connection due to an error.	Medium
Audit Database Mirroring Login - Authorization Failure	Created when an Authorization Failure event reports that a database mirroring endpoint denied authorization for the connection.	Medium
Audit Database Mirroring Login - Login Protocol Error	Created when a Login Protocol Error event reports that the database mirroring login receives a message that is well-formed but not valid for the current state of the login process.	Medium
Audit Database Mirroring Login - Login Success	Created when a Login Success event reports that the adjacent database mirroring login process has finished successfully.	Medium
Audit Database Mirroring Login - Message Format Error	Created when a Message Format Error event reports that the database mirroring login received a message that does not match the expected format.	Medium
Audit Database Mirroring Login - Negotiate Failure	Created when a Negotiate Failure event reports that the local database mirroring endpoint and the remote database mirroring endpoint support mutually exclusive levels of authentication.	Medium
Audit Database Object Access	Created when the database object is accessed with the identified permissions.	Medium
Audit Database Object GDR - Deny	Created when the permissions are denied.	Medium
Audit Database Object GDR - Grant	Created when the permissions are granted.	Medium
Audit Database Object GDR - Revoke	Created when the permissions are revoked.	Medium
Audit Database Object Take Ownership	Created when the object is assigned the new owner.	Medium
Audit Database Operation – Checkpoint	Created when the checkpoint operation occurred in the database.	Medium
Audit Database Operation - Subscribe to Query Notification	Created when subscription to query notification occurred in the database.	Medium
Audit Database Principal Impersonation	Created when an impersonation occurred within the database scope with the identified permissions.	Medium
Audit Database Scope GDR - Deny	Created when a DENY is issued for permissions for database-only actions.	Medium
Audit Database Scope GDR - Grant	Created when a GRANT is issued for permissions for database-only actions.	Medium
Audit Database Scope GDR - Revoke	Created when a REVOKE is issued for permissions for database-only actions.	Medium
Audit DBCC	Created when a DBCC command is issued.	Medium
Audit Disable Server Principal	Created when a server principal object is disabled.	Medium
Audit Drop Credential Mapping	Created when a credential mapping is dropped for the login.	Medium
Audit Drop Database	Created when the database is dropped.	Medium
Audit Drop Database Object	Created when the object is dropped.	Medium
Audit Drop Database Principal	Created when the Database Principle is dropped.	Medium
Audit Drop DB User	Created when the identified login is dropped as a database user.	Medium
Audit Drop Login	Created when the identified SQL Server login is removed from the server.	Medium
Audit Drop Login from Server Role	Created when the identified login is removed from the fixed server role.	Medium
Audit Drop Member from DB Role	Created when the identified login is removed from the database role.	Medium
Audit Drop Object with Derived Permission	Created when an object with derived permissions is dropped. (Disabled by default)	Medium
Audit Drop Role	Created when the database role is removed from the database.	Medium
Audit Drop Schema Object	Created when a schema object is dropped.	Medium
Audit Drop Server Object	Created when a server object is dropped.	Medium
Audit Drop Server Principal	Created when a server principal object is dropped.	Medium
Audit Dump Database	Created when the database is dumped.	Medium
Audit Dump Database Object	Created when the object is dumped.	Medium
Audit Dump Database Principal	Created when the Database Principle is dumped.	Medium
Audit Dump Object Derived Permission	Created when an object with derived permissions is dumped.	Medium
Audit Dump Schema Object	Created when a schema object is dumped.	Medium
Audit Dump Server Object	Created when a server object is dumped.	Medium
Audit Dump Server Principal	Created when a server principal object is dumped.	Medium
Audit Enable Server Principal	Created when a server principal object is enabled.	Medium
Audit External Access Server Operations	Created when an external access server operation is used.	Medium
Audit Grant Database Access to DB User	Created when the identified login is granted access to the database.	Medium
Audit Load Database Object	Created when the object is loaded.	Medium
Audit Load Database Principal	Created when the Database Principle is loaded.	Medium
Audit Load Object Derived Permission	Created when an object with derived permissions is loaded.	Medium
Audit Load Schema Object	Created when a schema object is loaded.	Medium
Audit Load Server Object	Created when a server object is loaded.	Medium
Audit Load Server Principal	Created when a server principal object is loaded.	Medium
Audit Login	Created when the user has successfully logged in to the SQL Server.	Medium
Audit Login Change Credential Property	Created when the credential property of the login has changed.	Medium
Audit Login Change Default Database Property	Created when the default database property of the login has changed.	Medium
Audit Login Change Default Language Property	Created when the default language property of the login has changed.	Medium
Audit Login Change Expiration Property	Created when the expiration property of the login has changed.	Medium
Audit Login Change Name Property	Created when the name property of the login has changed.	Medium
Audit Login Change Policy Property	Created when the policy property of the login has changed.	Medium
Audit Login Change Password - Changed	Created when the SQL Server login password is changed for the user.	Medium
Audit Login Change Password - Must Change	Created when the SQL Server login password must change for the user.	Medium
Audit Login Change Password - Reset	Created when the SQL Server login password is reset for the user.	Medium
Audit Login Change Password - Self Changed	Created when the SQL Server login password is self changed for the user.	Medium
Audit Login Change Password - Self Reset	Created when the SQL Server login password is self reset for the user.	Medium
Audit Login Change Password – Unlocked	Created when the SQL Server login password has been unlocked for the user.	Medium
Audit Login Change Policy Property	Created when the policy property of the login has changed.	Medium
Audit Login Failed	Created when the user tried to log in to the SQL Server and failed.	Medium
Audit Login GDR - Deny	Created when a Windows Login right is denied for the login.	Medium
Audit Login GDR - Grant	Created when a Windows Login right is granted for the login.	Medium
Audit Login GDR - Revoke	Created when a Windows Login right is revoked for the login.	Medium
Audit Logout	Created when the user has logged out of the SQL Server.	Medium
Audit Map Credential Login	Created when a credential is mapped to the login.	Medium
Audit Open Database Object	Created when the object is opened.	Medium
Audit Restore	Created when a restore command is issued.	Medium
Audit Revoke Database Access from DB User	Created when the identified login is revoked access to the database.	Medium
Audit Schema Object Access	Created when a schema object is used with permissions. (Disabled by default)	Medium
Audit Schema Object GDR - Deny	Created when permissions are denied for a schema object.	Medium
Audit Schema Object GDR - Grant	Created when permissions are granted to a schema object.	Medium
Audit Schema Object GDR - Revoke	Created when permissions are revoked from a schema object.	Medium
Audit Schema Object Take Ownership	Created when a schema object is assigned a new owner.	Medium
Audit Server Alter Trace	Created when a trace is altered. (Disabled by default)	Medium
Audit Server Object GDR - Deny	Created when permissions are denied for a server object.	Medium
Audit Server Object GDR - Grant	Created when permissions are granted to a server object.	Medium
Audit Server Object GDR - Revoke	Created when permissions are revoked from a server object.	Medium
Audit Server Object Take Ownership	Created when a server object is assigned to a new owner.	Medium
Audit Server Pause	Created when the SQL Server service is paused.	Medium
Audit Server Principal Impersonation	Created when an impersonation occurred within the server scope.	Medium
Audit Server Resume	Created when the SQL Server service is resumed.	Medium
Audit Server Scope GDR - Deny	Created when a DENY is issued for permissions in the server scope.	Medium
Audit Server Scope GDR - Grant	Created when a GRANT is issued for permissions in the server scope.	Medium
Audit Server Scope GDR - Revoke	Created when a REVOKE is issued for permissions in the server scope.	Medium
Audit Server Shutdown	Created when the SQL Server service is shutdown.	Medium
Audit Server Start	Created when the SQL Server service is started.	Medium
Audit Statement Permission	Created when statement permissions are used.	Medium
Audit Transfer Schema Object	Created when a schema object is transferred.	Medium

SQL Server Event

The SQL Server Event facility contains general server events.

Table 16. SQL Server events
Event	Description	Severity
Mount Tape Cancel	Created when a tape mount request is canceled.	Medium
Mount Tape Complete	Created when a tape mount request is completed.	Medium
Mount Tape Request	Created when a tape mount request is received.	Medium
Server Memory Decrease	Created when the memory usage is decreased for the SQL Server.	Medium
Server Memory Increase	Created when the memory usage is increased for the SQL Server.	Medium
Trace File Close	Created when a trace file has been closed during rollback.	Medium

SQL Session Event

The SQL Session Event facility contains general session events.

Table 17. SQL Session events
Event	Description	Severity
Plan Guide Successful	Created when the SQL Server successfully produces an execution plan for a query or batch that contained a plan guide.	Medium
Plan Guide Unsuccessful	Create when the SQL Server can not produce an execution plan for a query or batch that contained a plan guide.	Medium
PreConnect:Completed	Created when a LOGON trigger or the Resource Governor classifier function has finished execution	Medium
PreConnect:Starting	Created when a LOGON trigger or the Resource Governor classifier function started execution	Medium

SQL Stored Procedures Event

The SQL Stored Procedures Event facility contains general stored procedure events.

Table 18. SQL Stored Procedures events
Event	Description	Severity
RPC Output Parameter	Created when the output parameter values of a remote procedure call is available.	Medium
RPC:Completed	Created when a remote procedure call has been completed. (Disabled by default)	Medium
RPC:Starting	Created when a remote procedure call has started. (Disabled by default)	Medium
SP:CacheHit – Compplan Hit	Created when a complied plan was found in the plan cache. (Disabled by default)	Medium
Sp:CacheHit – Execution Context Hit	Created when a free execution plan was found in the plan cache. (Disabled by default)	Medium
SP:CacheInsert	Created when a stored procedure has been inserted into the procedure cache.	Medium
SP:CacheMiss	Created when a stored procedure is not found in the cache. (Disabled by default)	Medium
SP:CacheRemove - Compplan Remove	Created when a compiled query plan has been removed from the cache.	Medium
SP:CacheRemove – Proc Cache Flush	Created when all entries have been removed from the procedure cache.	Medium
SP:Completed	Created when a stored procedure has completed executing. (Disabled by default)	Medium
SP:Recompile – Browse Perms Changed	Created when a stored procedure has been recompiled for browse perms changes.	Medium
SP:Recompile – Cursor Options Changed	Created when a stored procedure has been recompiled for cursor options changes.	Medium
SP:Recompile – MPI View Changed	Created when a stored procedure has been recompiled for MPI view changes.	Medium
SP:Recompile – Query Notification Environment Changed	Created when a stored procedure has been recompiled for query notification environment changes.	Medium
SP:Recompile – Recompile DNR	Created when a stored procedure has been recompiled for DNR recompiles. (Disabled by default)	Medium
SP:Recompile – Recompile Option	Created when a stored procedure has been recompiled with recompile option.	Medium
SP:Recompile – Remote Rowset Changed	Created when a stored procedure has been recompiled for remote rowset changes.	Medium
SP:Recompile – Schema Changed	Created when a stored procedure has been recompiled for schema changes.	Medium
SP:Recompile – Set Option Changed	Created when a stored procedure has been recompiled for set option changes. (Disabled by default)	Medium
SP:Recompile – Statistics Changed	Created when a stored procedure has been recompiled for statistics changes. (Disabled by default)	Medium
SP:Recompile – Temp Table Changed	Created when a stored procedure has been recompiled for temp table changes.	Medium
SP:Starting	Created when a stored procedure is beginning execution. (Disabled by default)	Medium
SP:StmtCompleted	Created when a Transact-SQL statement within a stored procedure has completed. (Disabled by default)	Medium
SP:StmtStarting	Created when a Transact-SQL statement within a stored procedure has started. (Disabled by default)	Medium

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Change Auditor for SQL Server 7.3 - Event Reference Guide

SQL Security Audit Event

SQL Server Event

SQL Session Event

SQL Stored Procedures Event