Re: Question on C2 Log

From: Sue Hoegemeier (Sue_H_at_nomail.please)
Date: 10/07/04

  • Next message: boon: "Re: Question on C2 Log" 
    Date: Wed, 06 Oct 2004 20:15:44 -0600

    You can't modify the classes or events captured with C2
    auditing. You can write and run your own additional trace
    that captures the other events that you want to monitor.

    -Sue

    On Thu, 7 Oct 2004 09:04:50 +0800, "boon"
    <boon@newsgroup.nospam> wrote:

    >Hi,
    >
    >I have already setup the C2 Log. I am now analyzing the trace, but I
    >couldn't find everything, such as TSQL complete events. I find the
    >statements in the Audit Permission Object events but the values are hidden
    >in @P1, @P2, @P3. I want to find out what value is being used.
    >
    >Regards
    >
    >""Mingqing Cheng [MSFT]"" <v-mingqc@online.microsoft.com> wrote in message
    >news:6vVltK6qEHA.3036@cpmsftngxa06.phx.gbl...
    >> Hi Boon,
    >>
    >> Thanks for your post.
    >>
    >> From your descriptions, I understood that you would like to log C2 Audit.
    >> Have I understood you? Correct me if I was wrong.
    >>
    >> However, I am not sure how do you define "every thing". Do you mean
    >> auditing all logins no matter it is successfully or failed? If so, here
    >are
    >> four options for different audit level
    >>
    >> None -- causes no auditing to be performed.
    >> Success -- causes only successful login attempts to be audited.
    >> Failure -- causes only failed login attempts to be audited.
    >> All -- causes successful and failed login attempts to be audited.
    >>
    >> Take the following steps in SQL Enterprise Manager to set the appropriate
    >> Audit Level you wanted.
    >> 1. Expand a server group.
    >> 2. Right-click a server, and then click Properties.
    >> 3. Click the Security tab.
    >> 4. Under Authentication, click SQL Server and Windows.
    >> 5. Under Audit level, select the level at which user accesses to SQL
    >Server.
    >>
    >> If you want to use SQL Server Profiler to auditing SQL Server activity,
    >See
    >> topic "Auditing SQL Server Activity" in SQL Server BooksOnline and here
    >are
    >> some KB on the best practise for using SQL Profiler for your reference
    >>
    >> Support WebCast: SQL Server 2000 Profiler: What's New and How to
    >> Effectively Use It
    >> http://support.microsoft.com/default.aspx?scid=kb;en-us;325263
    >>
    >> Support WebCast: How to Effectively Use SQL Server Profiler
    >> http://support.microsoft.com/default.aspx?scid=kb;en-us;325297
    >>
    >> Thank you for your patience and corperation. If you have any questions or
    >> concerns, don't hesitate to let me know. We are here to be of assistance!
    >>
    >>
    >> Sincerely yours,
    >>
    >> Mingqing Cheng
    >>
    >> Online Partner Support Specialist
    >> Partner Support Group
    >> Microsoft Global Technical Support Center
    >> ---------------------------------------------------------------
    >> Introduction to Yukon! - http://www.microsoft.com/sql/yukon
    >> This posting is provided "as is" with no warranties and confers no rights.
    >> Please reply to newsgroups only, many thanks!
    >>
    >>
    >>
    >>
    >>
    >

  • Next message: boon: "Re: Question on C2 Log"

    Relevant Pages

    • Re: C2 SQL auditing
      ... I setup my SQL 2000 Server to use C2 auditing. ... My only problem is that my trace file does not get populated while I am ... when I stop SQL server then my trace file gets populated. ...
      (microsoft.public.sqlserver.security)
    • Re: Auditing in SQL Server 7.0
      ... > stuck how to proceed auditing in SQL Server 7.0. ... you can enable the 'Audit level'. ...
      (microsoft.public.sqlserver.security)
    • Re: Audit Trace Files
      ... I want to get all the trace files that have been created so far. ... In SQL Server 2005 take a look at sys.traces system table ... Every time I start the server, I define a new trace file for auditing. ...
      (microsoft.public.sqlserver.security)
    • Re: Full Text Indexing on Microsoft SQL Server 2000 with Windows XP Pro
      ... I went in there and I found the Auditing level set to None which ... > Editions of SQL Server 2000"). ... >> I am not seeing any unusual messages in the Event Viewer also. ...
      (microsoft.public.sqlserver.programming)
    • Re: Tracing sql server user logins
      ... Now for your question: base auditing ... > GroupName sysname NULL, ... SQL Server does not audit by ... >>Failure causes only failed login attempts to be audited. ...
      (microsoft.public.sqlserver.security)