Re: External logs collection and monitoring

From: Jasper Smith (jasper_smith9_at_hotmail.com)
Date: 11/29/04


Date: Mon, 29 Nov 2004 18:22:57 -0000

Server side traces (i.e. without using the Profiler GUI) can only write to
trace files. You can load trace files into a sql table (for example on a
central "audit" server) using the sytem function fn_trace_gettable. See BOL
for details

-- 
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"JMBickham" <JMBickham@discussions.microsoft.com> wrote in message 
news:AF4060D6-6986-4999-85E3-5B090EC39A53@microsoft.com...
> Essentially I am looking for a way to externally store db
> audit logs and to be able to parse the data or filter for specific events 
> and
> ids for review by a security team.  Something less manual than copying 
> trace
> files from the server to another server and going over each using profiler
> (we're talking about 30 servers here!)... but not necessarily as hands-off 
> as
> flagging and email alerting only.
>
> In going through support docs and threads here a couple questions have 
> also
> arisen...
>
> Does the table the trace dumps to have to be part of the local db?  Is it
> possible to have the trace dump to an external db server?
>
> In order to have trace dump the output to a table, does this require 
> setting
> up a job using SQL Trace stored procedures or can it be done just by 
> changing
> the server's auditing configuration? 


Relevant Pages

  • Re: User and Login auditing
    ... I agree 100% with Sue on not touching the system tables. ... > and hope that your employer doesn't mind you putting the SQL ... > Server box in this position. ... You could put triggers on your trace table. ...
    (microsoft.public.sqlserver.security)
  • Re: Problem with SQL Server [Solution]
    ... Apparently my sql server was not set to mixed mode authentication. ... > with the Trace Properties. ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: SQL 7 Traces
    ... Profiler 2K can generate the xp calls for a defined trace in 7 format. ... Tibor Karaszi, SQL Server MVP ...
    (microsoft.public.sqlserver.programming)
  • Re: URGENT deadlock question
    ... I have a deadlock template that I use with the following ... > SQL: Statement Completed ... > "Trace flags remain enabled in the server until disabled by executing ...
    (microsoft.public.sqlserver.server)
  • Re: SQL 7 Traces
    ... With SQL 7, you can simply use the SQL Profiler to trace the server. ... Profiler is a GUI tool that hooks into server events inside SQL Server. ...
    (microsoft.public.sqlserver.programming)