Obtaining Audit Information

Hi People

We want one trigger which captures the data as mentioned below.

Table Name

Date and Time

User

type

Mode of modification

TABLE_ABC

03/07/2007 12:00:04

XCS\Raoa

Update

Procedure

TABLE_DEF

03/07/2007 12:00:34

XCS\Raoa

Insert

Class Integration SSIS Package

TABLE_GHI

03/07/2007 12:01:04

XCS\Raoa

Insert

Procedure

TABLE_GHI

03/07/2007 12:01:34

XCS\Raoa

Update

XCS\Raoa (Manual)

I am not sure about how to achieve the last column. I hope u understand what exactly is expected. The idea is that, one should be able to track how a particular table was manipulate; whether it was manipulated using procedure or SSIS package or manually.

Could someone help me achieving this?

Regards

Abhi

Hi Abhi,

I think you are looking for a DDL trigger. Here is my example. We are monitoring the changes on views, procedures, etc. We are using this:

Code Snippet

USE [databasename]

GO

SET ANSI_NULLS ON

GO

SET QUOTED_IDENTIFIER ON

GO

SET ANSI_PADDING ON

GO

CREATE TABLE [dbo].[T_DDL_DDLEventLog](

[EventDate] [datetime] NOT NULL,

[UserName] [sysname] NOT NULL,

[ObjectName] [sysname] NOT NULL,

[CommandText] [varchar](max) NOT NULL

) ON [PRIMARY]

GO

SET ANSI_PADDING OFF

USE [databasename]

GO

SET ANSI_NULLS ON

GO

SET QUOTED_IDENTIFIER ON

GO

CREATE TRIGGER [DDL_Alter_Audit]

ON DATABASE

FOR ALTER_TABLE, ALTER_PROCEDURE, ALTER_FUNCTION, ALTER_VIEW, ALTER_TRIGGER

AS

DECLARE @.eventData XML

SET @.eventData = eventdata()

INSERT T_DDL_DDLEventLog (EventDate, UserName, ObjectName, CommandText)

SELECT

GETDATE() AS EventDate,

@.eventData.value('data(/EVENT_INSTANCE/LoginName)[1]', 'SYSNAME')

AS UserName,

@.eventData.value('data(/EVENT_INSTANCE/ObjectName)[1]', 'SYSNAME')

AS ObjectName,

@.eventData.value('data(/EVENT_INSTANCE/TSQLCommand/CommandText)[1]',

'VARCHAR(MAX)') AS CommandText

GO

SET ANSI_NULLS OFF

GO

SET QUOTED_IDENTIFIER OFF

GO

ENABLE TRIGGER [DDL_Alter_Audit] ON DATABASE

Also, you can find more informationabout DDL triggers in the BOL.

I hope it helps.

Regards,

Janos

|||

Thanks for replying Janos.

What does following statement return?

@.eventData.value('data(/EVENT_INSTANCE/TSQLCommand/CommandText)[1]',

'VARCHAR(MAX)') AS CommandText

Anyways, I m looking for DML triggers. Whenever someone inserts/updates the table, I wanna know how that table was manipulated..was it manipulated using SSIS package or stored procedure or manually by some user. Is it possible to capture this information

|||

Hi,

CommandText returns the T-SQL script ran against the object. Eg.: In got a table called Table1. when I'm going to alter it, the Command text will contain the altering sql script, like ALTER TABLE Table1 .....

LoginName will return the credentila used to make the alter on the table and the ObjectName return Table1, in this case.

You can make this DDL trigger for all database events with DDL_DATABASE_LEVEL_EVENTS event, but this still monitors the objects, not monitoring your DML actions. You should write DML triggers for all your tables required audit.

Regards,

Janos

|||

Thanks for you reply Janos.. Cheers!!!