We are implementing a monitoring solution that keeps track of logins to SQL Server. We need to capture the following event: a user logs in to a Windows client and from there logins to a remote SQL Server using SQL Authentication. When this occurs, we need to keep track of the Window user that logged into the Windows client. Is there any chance to configure SSMS to pass the credentials of currently logged-in Windows user to the SQL Server it is connecting to?

I have several of the following situations in a MySQL schema that I design for a custom CRM/ERP solution. 1. 1:N related tables SO and SO_ITEMS (SO is just one example I have several) that both need to have revisions. The data sets stored tend to be get pretty big for some of these tables and, according to the business rules I gathered, there will be many changes that need auditing so copying all the child items for each revision of the parent will not scale very well I predict. 2. N:N related tables SO and PO tables (where I use a pivot table of course) that needs to be audited also so that changes from at least one way imply (or may imply) storing an updated revision of the data entry form the other table. (We need no worry about the child _items data entries for each of these tables because although they may be related, I don't require auditing for now). My strategy for now is to use a separate table suffixed with _revision for each of the above tables and store the current revision number in the normal table and a revision number for each revision, at least for the parents. So my question are: * is my schema flawed in some major way that I don't predict for this kind of scenario? (I suppose there are many other applications that have solved this problem out there). * should I make a direct relationship between x_revison and y_revision or use the revision number and query through the normal (current revision?) table? I want the variant that reduces complexity the most and I'm pretty sure querying through is simpler on most operations (I suspect there will not be a big disparity between SELECT/INSERT/UPDATE in normal operation, so I don't need to optimise for one type of DB operation). Am I missing something? * is it common practice to copy-on-write the revisions or should I just lazily insert entries in the revisions table when a change appears only? Any possible pros/cons to these two options.

I'm configuring SQL Server Audit to log all INSERT, UPDATE, DELETE, and SELECT operations. I've tested and recorded everything I need (time, action, server principal, server instance, database name, object name, statement). The only thing missing and that I couldn't find is the field that stores the changes before they're modified by UPDATE and DELETE. If someone changes them, I need to know what was stored beforehand. Could someone help me? Thank you.

My goal: 1. Show all tables from specific schema which are used in SELECT queries for all users in SQL Server database. 2. [Optional] Show all tables from specific schema which are used in queries for all users (around 300 sql and AD users) except one user in SQL Server database. I have added specification: But still see deletes/inserts/updates: Questions: 1. Is audit log best option to achieve my goal ? 2. What specification should I use ?

How do you correlate SQL Database Audit log column "transaction_id" with a LSN either from the trans log or a CDC capture table? I am trying to do this because cdc only captures the data changes, while SQL Audit captures the who, when and what made the change. I am trying to correlate the two. thx ~j

I'm trying to set up an Audit facility on a DB2 AWSE V10.5 FP5 database running on Red Hat Linux Server 6.8. The definition for the policy is : ALTER AUDIT POLICY Failures CATEGORIES Audit STATUS Failure, Checking STATUS Failure, Context STATUS Failure, ObjMaint STATUS Failure, SecMaint STATUS Failure, **execute with data STATUS Failure**, Validate STATUS Failure ERROR TYPE NORMAL ; This is producing data for all the categories, except EXECUTE. My test script includes statements that fail with SQL0204, SQL0206, etc. but no data is extracted into the execute.del file in the audit output. Anyone have an idea what I'm missing?

I'm working with a large SQL Server database that contains approximately 1000 tables across several schemas. I need to determine which of these tables are actually being used in user queries, stored procedures, views, functions, and ad-hoc queries. What I've considered so far: - SQL Server Audit - Setting up auditing to track table access, but I'm concerned about the performance impact and log volume with so many tables. - Query Store - I'm wondering if Query Store can help identify which tables are being referenced in queries, but I'm not sure if it can track all the objects I need across schemas. My goal is to generate a report showing which tables are actively used and which ones might be candidates for archiving or removal. I need to track all types of access including: SELECT/INSERT/UPDATE/DELETE operations, References in views, Usage in stored procedures and functions, Ad-hoc queries from applications Is Query Store the right approach for this, or would SQL Server Audit be better? Are there other options I should consider for tracking table usage at this scale with minimal performance impact? Thanks in advance for any advice or recommendations!

I want to log the Execution Time and Parameters for every stored procedure call on my database. What I reached by searching is to use extended events as the latest method with minimum performance overhead. My aim is to achieve a similar result as the 'rpc_completed' event of 'extended events', but the problem with using extended events is that their sessions log output into .xe* files and there is no option to choose a database table as far as I read from tutorials/docs. Can I (by any means), redirect extended events logs to a database table synchronously? I can sacrifice hardware resources for this, but can't pick methods like triggering interval-ed queries to read from *.xe files and insert them into a database table

I'm a MS SQL guy and understand agent job history. I'm now working with MySQL. I've searched hi and low but I can't find any solid info on how event data within information_schema.events is persisted, retained for. I plan to setup some MySQL Events but need to understand how reliable the logs are. I don't think we have anything in our my.cnf with regards to retention periods of information_schema. If it's forever - should I try and clean this up with some house-keeping job? I am making events to fire once a week. Ideally these would be retained for 180 days. Events that fire more regularly every 5 minutes, perhaps should only be retained for a month. how do I extend this/ manage this - do people log to a separate table that you can manage yourself?

I set up an audit in SQL Server that saves audit logs (.sqlaudit files) to RDS, which we then copy over to S3 using a standard process. All of the documentation I can find on reading these audit files uses the following query to read them from RDS: SELECT * FROM msdb.dbo.rds_fn_get_audit_file ('D:\rdsdbdata\SQLAudit\transmitted\*.sqlaudit' ,default,default) RDS has an option setting called RETENTION_TIME for SQL Server Audit which allows you to specify a maximum of 840 hours before the files are removed from the RDS instance. I need to to be able to read the audit files for a longer period of time, so I am looking for a way to query the audit files in S3 instead, where they are retained. One way may be to use sys.fn_get_audit_file, but I cannot do this with any user attached to this server that my organization has access to, even the admin user. None of the users have proper permissions for this and I don't see any way they can be granted. With the .sqlaudit files sitting in the S3 bucket, how could I go about reading the files? Perhaps S3 Select could do it somehow, or maybe there's another obvious solution I'm overlooking?

I have an application that accesses my SQL Server using a username\password. However our lead developer has access to this password and I suspect that he may be utilizing this outside of our terms of agreement. My wish is to audit for anytime this username (appaccount) accesses our database and any commands that are issued. Luckily this application uses purely stored procedures with passed in parameters when it accesses the database so anytime the account runs a T-SQL statement it has to be from our developer in question. My ideal output would be something like this: Datetime | Username | Action Performed 11:23am | appaccount | "Select * from claimstable"| 11:26am | appaccount | "update table ...(skip change control process)"|

There's any way to find out who stopped\restarted\started the following services ? - SQL Server Database Engine - SQL Server Agent - SQL Server Analysis Services Thanks !

I'm trying to implement a system to track all read-only operations on our MongoDB deployment with the following constraints: Requirements: - Need to track all read operations (find, aggregate, etc.) hitting our MongoDB server - Solution must be free (no MongoDB Enterprise/Atlas features) - Minimal performance impact on production workload - Complete coverage of operations from all clients/applications What I've already tried: 1. **system.profiler**: Too much performance impact when tracking all operations 2. **currentOp()**: Missing many read operations due to their short lifecycle 3. **MongoDB logs**: Difficult to parse efficiently and adds I/O overhead 4. **Change streams**: Don't capture read-only operations 5. **Driver command monitoring**: Only captures operations from the specific application instance where it's implemented Has anyone successfully implemented a solution for comprehensive read operation tracking in a similar environment? What approach would you recommend given my constraints?

We want to keep track of changes being done to MySQL procedures only, actually recently our procedures seem to have overwritten to some previous versions and we were unable to track it that who did this. We were able to track thread-id from mysqlbinlog but were not able to determine whose userid was using that thread-id. Is there any way by which we can do following **• Track user-id from mysqlbinlog thread-id • Keep track of every create procedure/drop procedure** We are using MySQL 5.7.20 community edition on windows 10 & CentOS7 and we are using row level bin-logging Any help is greatly appreciated.

I am trying to audit any user modification action (create user/alter user/drop user/rename user) on a MySQL Enterprise server 5.7.24. I have installed the audit_log plugin following the [ document](https://dev.mysql.com/doc/refman/5.7/en/audit-log-installation.html) , and tried to configure the filter with a few approaches. First, I tried to use [general](https://dev.mysql.com/doc/mysql-security-excerpt/5.7/en/audit-log-filter-definitions.html#audit-log-general-event-fields)

SELECT audit_log_filter_set_filter('user_modification', 
'{
  "filter": {
    "class": {
    "name": "general",
      "event": {
        "name": "status",
        "log": {
          "field": { "name": "general_sql_command.str", "value": "create_user" }
        }
      }
    }
  }
}') as RESULT;

and assigned the filter to everyone but no luck, it doesn't generate any audit log when I tried to create user

SELECT audit_log_filter_set_user('%', 'user_modification');

I also tried to swap a few things in the same filter, no luck - swap 'create user' with full instrument name 'statement/sql/create_user' - swap 'general_sql_command.str' with 'general_command.str' Next, I tried to use '[table_access](https://dev.mysql.com/doc/mysql-security-excerpt/5.7/en/audit-log-filter-definitions.html#audit-log-table-access-event-fields) ' instead of '[general](https://dev.mysql.com/doc/mysql-security-excerpt/5.7/en/audit-log-filter-definitions.html#audit-log-general-event-fields) ', hopeful it will capture any movement on mysql.user table, but still not luck

SELECT audit_log_filter_set_filter('user_modification', 
'{
  "filter": {
    "class": [
      {
        "name": "table_access",
        "event": {
          "name": [ "read", "insert", "delete", "update" ],
          "log": {
            "field": { "name": "table_database.str", "value": "mysql"},
            "field": { "name": "table_name.str", "value": "user"}
          }
        }
      }
    ]
  }
}') as RESULT;

Just in case I missed out on any step during installation, I created another filter for test and the result is positive.

SELECT audit_log_filter_set_filter('connection', 
'{
  "filter": {
    "class": { "name": "connection" }
  }
}');

SELECT audit_log_filter_set_user('%', 'connection');

Now I am totally puzzled, can anyone help me? thanks 🙏

I have configured the login audit to save only the failed ones, but I need to omit a specific login in said audit, is it possible? I am using sqlserver 2008-r2

I have the following SQL Server Audit: CREATE SERVER AUDIT [Omega_CA_Srv_Aud] TO FILE ( FILEPATH = N'C:\MS_Sql_Server_Audit\' ,MAXSIZE = 100 MB ,MAX_FILES = 3 ,RESERVE_DISK_SPACE = OFF ) WITH (QUEUE_DELAY = 1000, ON_FAILURE = CONTINUE, AUDIT_GUID = '45b8fdb5-dbe5-4550-b115-e9cac5ef327b') When I try to enable it, I get the following error: > TITLE: Microsoft.SqlServer.Smo > > Enable failed for Audit 'Omega_CA_Srv_Aud'. > > For help, click: https://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=17.100.31.0&EvtSrc=Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText&EvtID=Enable+Audit&LinkId=20476 > > ADDITIONAL INFORMATION: > > An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo) > > Audit 'Omega_CA_Srv_Aud' failed to start . For more information, see the SQL Server error log. You can also query sys.dm_os_ring_buffers where ring_buffer_type = 'RING_BUFFER_XE_LOG'. (Microsoft SQL Server, Error: 33222) It was working before. One (MS) day it failed to start. I have given full permissions to Everyone on the OS directory ... but still the same issue persists. The disk volume is 60 Gb and 39 Gb are free. at SQL Server Log do see the following: Date,Source,Severity,Message 04/13/2025 23:12:57,spid61,Unknown,Audit: Server Audit: 65536 Initialized and Assigned State: TARGET_CREATION_FAILED 04/13/2025 23:12:57,spid61,Unknown,SQL Server Audit failed to create an audit file related to the audit 'Omega_CA_Srv_Aud' in the directory 'C:\MS_Sql_Server_Audit'. Make sure that the disk is not full and that the SQL Server service account has the required permissions to create and write to the file. 04/13/2025 23:12:57,spid61,Unknown,Error: 33244 Severity: 17 State: 1. 04/13/2025 23:12:57,spid61,Unknown,SQL Server Audit failed to create the audit file 'C:\MS_Sql_Server_Audit\Omega_CA_Srv_Aud_45B8FDB5-DBE5-4550-B115-E9CAC5EF327B_0_133890523773110000.sqlaudit'. Make sure that the disk is not full and that the SQL Server service account has the required permissions to create and write to the file. 04/13/2025 23:12:57,spid61,Unknown,Error: 33206 Severity: 17 State: 1. 04/13/2025 23:12:57,spid61,Unknown,Audit: Server Audit: 65536 State changed from: START_FAILED to: TARGET_CREATION_FAILED 04/13/2025 23:12:57,spid61,Unknown,Audit: Server Audit: 65536 Initialized and Assigned State: START_FAILED 04/13/2025 23:12:57,spid61,Unknown,Audit: Server Audit: 65536 Session has been closed 04/13/2025 23:12:57,spid61,Unknown,Audit: Server Audit: 65536 State changed from: TARGET_CREATION_FAILED to: SHUTTING_DOWN 04/13/2025 23:12:57,spid61,Unknown,Audit: Server Audit: 65536 Session is being closed. Audit Guid: 45B8FDB5-DBE5-4550-B115-E9CAC5EF327B Version is Developer Edition 2019

In Oracle database ,we can direct audit records to either db , os or in xml file by using the below command: ALTER SYSTEM SET AUDIT_TRAIL= DB SCOPE=SPFILE; But is it possible to direct audit records to both db and os(both) like the below command which results in error: ALTER SYSTEM SET AUDIT_TRAIL= DB,OS SCOPE=SPFILE;

Has anyone had any luck using the audit_log_filter plugin / component from Percona? I have installed Percona Server for MySQL 8.0 (8.0.41-32) and Percona Server for MySQL 8.4 (8.4.3-3) and followed the instructions to install it. I'm using Debian 12 (bookworm) if that makes any difference. e.g. 1) run the script audit_log_filter_linux_install.sql to create the two tables and install the plugin / component. 2) set up logging using: SELECT audit_log_filter_set_filter('log_all', '{"filter": {"log": true}}'); SELECT audit_log_filter_set_user('%', 'log_all'); This should enable logging of all events for all users. I then run a series of queries, that include create schema / create table / insert / update / delete / drop etc. I've tried it with different users I've tried it on workbench and from the cmdline And yet the only thing that ever appears in the log is: Audit 0_2025-03-13T11:47:51 2025-03-13T11:47:51 1 which is generated when the server restarts. Am I missing something, or does it simply not work?

I am trying to produce a monthly report on Audit. I am able to query the DBA_AUDIT_TRAIL, for all other users and no issue in that. I wanted to include the SYS/SYSDBA activities in this report and I know this is not recorded in SYS.AUD$ table but its recorded as an operating system files called .AUD. I know this is done to make sure that DBAs don't go and modify these data. Because this is just a reporting how can I get this details to my report? Is there a way I can query the operating system files eg. XXXX.AUD ? Thanks