Microsoft® SQL Server® 2012 Bible

974

Part VII: Monitoring and Auditing

Viewing the Audit Trail

The easiest way to view the audit trail is to select the SQL Server Audit in Object Explorer

and select View Logs in the context menu. This opens the Log File Viewer to the Audit

Collection, as shown in Figure 42-4. The fi lter is useful to narrow the event viewed.

FIGURE 42-4

Viewing the audit history using Management Studio’s Log File Viewer. Here, select state-

ments issued in AdventureWorks2012 are audited on a per-table basis.

Using T-SQL, the logs can be read with the fn_get_audit_file function.

Enhancements have been made to Management Studio in SQL Server 2012 with the addition

of new audit dialog boxes. These include the ability to manage the new fi lter audits fea-

ture. Additionally, you can now view the Windows NT logs; however, this feature is avail-

able in more than just SQL Audit.

Summary

Extended Events is a powerful, new auditing technology for Windows and SQL Server. By

itself Extend Events take a lot of work to use. SQL Audit is a powerful collection of objects,

easily confi gured, that extends and leverages Extended Events and makes it useful today.

If your shop runs a version of SQL Server that supports SQL Server Audit, there is no reason

c42.indd 974c42.indd 974 7/31/2012 10:17:49 AM7/31/2012 10:17:49 AM

http://www.it-ebooks.info