Reading SQL Server .sqlaudit Files Stored in S3
I set up an audit in SQL Server that saves audit logs (.sqlaudit files) to RDS, which we then copy over to S3 using a standard process. All of the documentation I can find on reading these audit files...
View ArticleIs it possible to set Audit_trail parameter to both DB and OS in Oracle database
In Oracle database ,we can direct audit records to either db , os or in xml file by using the below command:ALTER SYSTEM SET AUDIT_TRAIL= DB SCOPE=SPFILE;But is it possible to direct audit records to...
View ArticleWhat is the best way to setup SQL Server audit to get all SELECT for schema?
My goal:Show all tables from specific schema which are used in SELECT queries for all users in SQL Server database.[Optional] Show all tables from specific schema which are used in queries for all...
View ArticleConfigure Login Audit - Skip one user-
I have configured the login audit to save only the failed ones, but I need to omit a specific login in said audit, is it possible?I am using sqlserver 2008-r2
View ArticleTrack MySQL Procedure Changes in MySQL
We want to keep track of changes being done to MySQL procedures only, actually recently our procedures seem to have overwritten to some previous versions and we were unable to track it that who did...
View ArticleDiscover who changed SQL Server service state
There's any way to find out who stopped\restarted\started the following services ?SQL Server Database EngineSQL Server AgentSQL Server Analysis ServicesThanks !
View ArticleAuditing a Single User in SQL Server
I have an application that accesses my SQL Server using a username\password. However our lead developer has access to this password and I suspect that he may be utilizing this outside of our terms of...
View ArticleMySQL - Information_schema Events - How persistent or retention is managed
I'm a MS SQL guy and understand agent job history.I'm now working with MySQL.I've searched hi and low but I can't find any solid info on how event data within information_schema.events is persisted,...
View ArticleMSSQL - How to log every rpc_completed event into a table?
I want to log the Execution Time and Parameters for every stored procedure call on my database.What I reached by searching is to use extended events as the latest method with minimum performance...
View ArticleDB2 Audit Policy not producing EXECUTE data
I'm trying to set up an Audit facility on a DB2 AWSE V10.5 FP5 database running on Red Hat Linux Server 6.8. The definition for the policy is :ALTERAUDIT POLICY Failures CATEGORIES Audit STATUS...
View ArticleHow do you correlate SQL Database Audit spec's log column transaction_id with...
How do you correlate SQL Database Audit log column "transaction_id" with a LSN either from the trans log or a CDC capture table?I am trying to do this because cdc only captures the data changes, while...
View ArticleStoring revisions and relations between revised items in 1:N and N:N...
I have several of the following situations in a MySQL schema that I design for a custom CRM/ERP solution.1:N related tables SO and SO_ITEMS (SO is just one example I have several) that both need to...
View ArticleKeeping track of client logged-in OS user when connecting to a database server
We are implementing a monitoring solution that keeps track of logins to SQL Server.We need to capture the following event: a user logs in to a Windows client and from there logins to a remote SQL...
View ArticleHow to check Auditing in Azure MSSQL MI?
I know that auditing is currently enabled in my azure MSSQL server, but how can I access these log files?Could it be done through SSMS?I need to know details about user activity in my databaase.
View ArticleCan I audit all actions of a database role?
I know from AskTom that we can audit all actions of a particular user account, e.g.:create audit policy test_audit_policy actions all when q'!sys_context('userenv', 'session_user') =...
View ArticleIdentify user who performed last_user_update in SQL Server
I can identify when a table was last accessed using this query:SELECT SCHEMA_NAME(schema_id) AS schema_name, name AS table_name, last_user_seek, last_user_scan, last_user_lookup, last_user_update,...
View ArticleAuditing/Monitoring the DBA
We have a customer that would like to make sure that certain tables are not tampered with by their DBAs for compliance reasons.From my understanding their DBAs either do have or are able to run with...
View ArticleSQL server Audit- Does it cause overhead
If I enable Audit on production databases that have over 100 m rows and have constant DML statements going (24 hours), is that going to cause any overhead on SQL server performance or tempdb? Does that...
View ArticleI need to audit all actions for a user on all databases - not sure best way
I have a user on a SQL Server that is used for executing SSRS queries. This user was made a sysadmin before I started at this job. I want to remove the sysadmin permission, but not break any reports. I...
View ArticleExtended events vs SQL Audit - performance implications
I would like to setup an audit trail kind of system on my database to monitor for UPDATE/INSERT statements on a specific table with very high activity. I have two options in front of me: using the SQL...
View ArticlePostgresql Incomplete log line in case of Update query
Below are the configurations for logs:logging_collector = onlog_destination = 'csvlog'log_directory = '/var/log/'log_filename = 'postgresql-16-main'log_statement = ddllog_min_duration_statement =...
View ArticleFind who is selecting from table SQL Server
We have a table that has a very long update process that I think was from a no longer used program. No one can seem to tell me if anyone still uses it or not.What is the best way to log which users...
View ArticleAuditing user queries of specific rows in a table
Is it possible in SQL Server 2017 and upwards to audit the access to certain rows in a table? Imagine a customer table, and we wanted to track when users selected the data for premium customers...
View ArticleEnsure replication commands have not been sent to an unexpected host
My company had been tasked with ensuring'replication commands that are executed in your database cluster are not off-loaded to an unexpected/undesired location'. As mitigation, log_replication_commands...
View ArticleSQL Server Audit Successful Login Group blank host name
I have an audit writing to file and an audit specification capturing SUCCESSFUL_LOGIN_GROUP.I notice the host_name is blank when reading some rows via sys.fn_get_audit_file. There is no pattern to the...
View ArticleGet date from SQL Server audit filename
SQL Server audit filenames use the following pattern:Name_GUID_PartitionNumber_Timestamp.sqlauditAn example filename...
View ArticleIs the SENSITIVITY_CLASSIFICATION_CHANGE_GROUP audit action undocumented?
The documentation for SQL Server audit seems very sparse and I wonder if I have completely missed its hiding place. Today, I read this awesome article by Andreas Wolter, who is an utter expert on the...
View ArticleCan a Windows Group be audited with SQL Server Audit?
I don't trust a certain Windows Group. I want to see everything that they do and I want to use SQL Server Audit to do it. As far as I can tell, SQL Server Audit does not support this. Is there a...
View ArticleCan a login audit stop applications from connecting to a database?
Is it true that if you configure a SQL Server security login audit and it fills up a disk dedicated for auditing and a DBA tools database, it can stop logins to application databases on the same instance?
View ArticleWhat metrics directly expose the performance impact of an Extended Event or...
Whenever I try to read up on the performance overhead of Extended Events or SQL Server Audit, I find that people measure it indirectly. For example, they will take some measurements while running a...
View Article