Re: Tracing addlogin event

From: Jasper Smith (jasper_smith9_at_hotmail.com)
Date: 12/14/04


Date: Tue, 14 Dec 2004 18:45:55 -0000

You need the following events

Audit AddloginEvent
Audit Login GDR Event

plus the TargetLoginName column (select on the Data Columns tab of Profiler)
These will give you the name (in the TargetLoginName column) of any SQL or
Windows logins created or dropped using either sp_addlogin or sp_grantlogin.
You will never get the exact text for sp_addlogin as it gets replaced for
security reasons

-- 
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"German" <german.koninin@crmDASHworldwideDOTnet> wrote in message 
news:%23q3Bk3c4EHA.2568@TK2MSFTNGP11.phx.gbl...
> Hello.
> I have an application that is creating a users in sql server. I feel it is
> doing bad things. So I need to take a look how it is inside. For that I've
> tried to use SQL Profiler. But! I found that it is impossible to trace
> sp_addlogin and such. I was disappointed. As I found it is impossible to
> make profiler trace it. Am I right?
>
> Ok, so I've tried a second opportunity. It was a trace. Ive created (using
> sp_trace_create) a trace. and add event nuber 104 wich is Audit Add/Drop
> Login. After my trace was running I found an event in a file that was
> created. But! There was just a header like "Audit Addlogin Event". But 
> there
> was no additional information (such as parameters of sp_addlogin) 
> provided.
>
> You know, after that I feel disappointed of MSSQL 2000...
>
> Now back to business. Could you suggest me how to handle such an event?
>
> Thanks a lot.
>
> --
> ----
>
> German Koninin
>
> ---------------------------------------
>
> For every complex problem, there's solution that is simple, neat and
> wrong...
>
>
>
> 


Relevant Pages

  • Re: Running profiler on busy 8-cpu Sql Server
    ... I always start with a light trace and add more detail as I go along to ... SQL Server MVP ... > I think it's also worth saying that you should introduce Profiler ... > SQL Server MVP ...
    (microsoft.public.sqlserver.server)
  • Re: URGENT deadlock question
    ... > Profiler to view a trace, SQL Server dumps rowsets across the network to ... > SQL Server doesn't feel like it can keep up with all the activity. ... > server-side trace to a trace file guarantees you'll see everything. ...
    (microsoft.public.sqlserver.server)
  • RE: SQL Server 2000 Profiler (Bug?)
    ... could trace many Error 208 by using Profiler when you using SQL Server ... Enterprise Manager navigate around in the Server.Have I fully understood ...
    (microsoft.public.sqlserver.server)
  • Re: Track deadlocks and locks that take too long
    ... I looked at the trace definition in your example code and it had the value 2 which means just that. ... Tibor Karaszi, SQL Server MVP ... As long as you tell it to on the General page of the profiler. ... declare @TraceID int ...
    (microsoft.public.sqlserver.programming)
  • RE: Insert Performance Degradation
    ... Use Profiler to trace the statements sent to sql server. ... duration template and filter for duration greater than, let us say, 1000 ...
    (microsoft.public.sqlserver.programming)