Scribd
Upload
2 views

SQL Server Logs Extended Events Audits

The document provides an overview of SQL Server Logs, Extended Events, and Audits, detailing their purposes and how to access them. SQL Server Logs record activities and errors, Extended Events offer lightweight performance monitoring, and Audits track security-related activities. Instructions for viewing logs and setting up audits in SQL Server Management Studio (SSMS) are included, along with example SQL queries for creating sessions and audits.

Uploaded by

fanuelmelaku22
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
2 views

SQL Server Logs Extended Events Audits

The document provides an overview of SQL Server Logs, Extended Events, and Audits, detailing their purposes and how to access them. SQL Server Logs record activities and errors, Extended Events offer lightweight performance monitoring, and Audits track security-related activities. Instructions for viewing logs and setting up audits in SQL Server Management Studio (SSMS) are included, along with example SQL queries for creating sessions and audits.

Uploaded by

fanuelmelaku22
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

SQL Server Logs, Extended Events, and Audits

1. SQL Server Logs


SQL Server logs record different activities and errors occurring in the database. These logs
help monitor system performance, troubleshoot issues, and track security events.

Types of SQL Server Logs:


• Error Log – Stores system messages, errors, and login failures.

• Agent Log – Tracks SQL Server Agent job execution details.

• Transaction Log (LDF) – Records all database changes before they are committed.

• Windows Event Log – Logs SQL Server-related events in Windows Event Viewer.

• Audit Log – Tracks security-related activities (if enabled).

How to View Logs in SQL Server:


• Use SQL Server Management Studio (SSMS)

• Run the following query to check the error log:

EXEC sp_readerrorlog;

2. SQL Server Extended Events (XEvents)


Extended Events (XEvents) is a lightweight performance monitoring and troubleshooting
tool. It replaces SQL Profiler and provides better performance tracking.

Why Use Extended Events?


✅ Low resource usage

✅ Real-time monitoring of SQL performance

✅ Customizable event tracking

How to View Extended Events in SSMS?


1. Open SSMS

2. Navigate to Management → Extended Events → Sessions

3. Right-click a session → Click Start to capture events

4. View results in Live Data

Basic Query to Create an XEvents Session:


CREATE EVENT SESSION MySession
ON SERVER
ADD EVENT sqlserver.sql_statement_completed
ADD TARGET package0.ring_buffer;
GO
ALTER EVENT SESSION MySession ON SERVER STATE = START;

3. SQL Server Audits


SQL Server Audits track and log security-related activities, such as who logged in, what data
was accessed, and what changes were made.

Why Use SQL Audits?


✅ Tracks logins and logouts

✅ Monitors database modifications

✅ Helps with security compliance (GDPR, HIPAA, etc.)

✅ Detects unauthorized activity

How to Set Up an SQL Audit in SSMS:


1. Navigate to Security → Audits

2. Right-click and select New Audit...

3. Name the audit and choose Audit Destination (file, security log, or application log)

4. Click OK, then enable the audit

SQL Query to Create an SQL Audit:


CREATE SERVER AUDIT MyAudit
TO FILE (FILEPATH = 'C:\SQL_Audit\MyAuditLog.sqlaudit');
ALTER SERVER AUDIT MyAudit WITH (STATE = ON);

SQL Query to Create an Audit Specification:


CREATE DATABASE AUDIT SPECIFICATION MyAuditSpec
FOR SERVER AUDIT MyAudit
ADD (SELECT ON DATABASE::MyDB BY public);
ALTER DATABASE AUDIT SPECIFICATION MyAuditSpec WITH (STATE = ON);

How to View Audit Logs in SSMS:


• Go to Security → Audits

• Right-click → View Audit Logs

You might also like