demo table:
create table test ( a nvharchar(100));
trigger record table:
CREATE TABLE [dbo].[DMLEvents](
[EventDate] [datetime] NOT NULL DEFAULT (getdate()),
[EventType] [nvarchar](64) NULL,
[EventDML] [nvarchar](max) NULL,
[EventXML] [xml] NULL,
[DatabaseName] [nvarchar](255) NULL,
[SchemaName] [nvarchar](255) NULL,
[ObjectName] [nvarchar](max) NULL,
[HostName] [varchar](64) NULL,
[IPAddress] [varchar](32) NULL,
[ProgramName] [nvarchar](255) NULL,
[LoginName] [nvarchar](255) NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
GO
DML trigger for that table:
create or alter TRIGGER [dbo].[DMLTrigger_Sample]
ON [dbo].[test]
after INSERT,delete,update
AS
BEGIN
SET NOCOUNT ON;
SET ANSI_WARNINGS OFF;
DECLARE
@EventData XML = EVENTDATA();
DECLARE
@ip VARCHAR(32) =
(
SELECT client_net_address
FROM sys.dm_exec_connections
WHERE session_id = @@SPID
);
DECLARE
@SQL1 VARCHAR(MAX) =
(
select t.text
from sys.sysprocesses
cross apply sys.dm_exec_sql_text (sql_handle) t
where spid=@@SPID
);
INSERT dbo.DMLEvents
(
-- EventType,
-- EventDML,
-- EventXML,
DatabaseName,
-- SchemaName,
ObjectName,
HostName,
IPAddress,
ProgramName,
LoginName
)
SELECT
-- @EventData.value('(/EVENT_INSTANCE/typedesc)[1]', 'NVARCHAR(100)'),
-- @EventData.value('(/EVENT_INSTANCE/TSQLCommand)[1]', 'NVARCHAR(MAX)'),
-- @EventData,
DB_NAME(),
-- @EventData.value('(/EVENT_INSTANCE/SchemaName)[1]', 'NVARCHAR(255)'),
-- @EventData.value('(/EVENT_INSTANCE/ObjectName)[1]', 'NVARCHAR(255)'),
@SQL1,
HOST_NAME(),
@ip,
PROGRAM_NAME(),
SUSER_SNAME();
END
GO
We have to contine:
instance audit
CREATE SERVER AUDIT [OurAudit]
TO FILE
( FILEPATH = N'C:\mssql_audit\'
,MAXSIZE = 0 MB
,MAX_ROLLOVER_FILES = 2147483647
,RESERVE_DISK_SPACE = OFF
)
WITH
( QUEUE_DELAY = 1000
,ON_FAILURE = CONTINUE
,AUDIT_GUID = '747fc00d-2745-4705-9a94-6c9fb6dea9bc'
)
ALTER SERVER AUDIT [OurAudit] WITH (STATE = ON)
GO
special database special table audit:
CREATE DATABASE AUDIT SPECIFICATION [OurAudit_test]
FOR SERVER AUDIT [OurAudit]
ADD (DELETE ON OBJECT::[dbo].[test] BY [public]),
ADD (INSERT ON OBJECT::[dbo].[test] BY [public]),
ADD (UPDATE ON OBJECT::[dbo].[test] BY [public])
WITH (STATE = ON)
GO
Here we begin:
(1) insert an demo date
insert into test values ('ghgh')
select * from test
result is
a
ghgh
(2) select audit record:
select * from [DMLEvents]
----
SELECT DATEADD(hh, DATEDIFF(hh, GETUTCDATE(), CURRENT_TIMESTAMP), event_time )
as corrected_time,
action_id ,
session_server_principal_name,
server_instance_name ,
database_name ,
schema_name ,
object_name ,
statement ,
file_name FROM fn_get_audit_file( 'C:\mssql_audit\OurAudit_*.sqlaudit' , DEFAULT , DEFAULT);
what can I see ?
Comments