Solved

SQL Server auditing for user logins

Posted on 2011-03-16
3
710 Views
Last Modified: 2012-05-11
Hi,
We are using SQL 2008 R2, and the requirement is rather simple, it is to have auditing for successful user logins and failed user logins to our database server.

Management wants to see: a] user name, b] time and c] application name (example: sql server management studio) used for logging-in or connect to SQL server.
We have a couple of options before us that I know of:
1.      Enable ‘enable both failed and successful logins’ from server properties window.
2.      Configure Audits and Server Audit Specification from Security folder in SQL Server.
However above options do not give any information about the application name used to login to SQL Server, also the other thing I notice when I tried auditing for ‘failed login’ and ‘successful login’ on my personal computer connected to my local instance, it constantly enters new ‘login success’ entries to audit file even when I am logged in once and not constantly logging-in, not sure why this happens.

And another way could be to extract from default trace and this method gives the application name but it gives information only about failed logins and not the succeeded ones. And since default traces are system created, not sure if we can configure it to log ‘login success’ information also.

We also are required to ensure not to put the server under too much stress while auditing.

Please do let me know your suggestion as to which is the best way? Is there any other way to achieve this?
0
Comment
Question by:navindba
  • 2
3 Comments
 
LVL 14

Expert Comment

by:Daniel_PL
ID: 35150691
You can use server side traces, you can adapt following to your needs:
http://www.mssqltips.com/tip.asp?tip=1035
http://www.sqlservercentral.com/articles/Performance/71549/
http://support.microsoft.com/kb/270599

You can find trace events to catch:
http://msdn.microsoft.com/en-us/library/ms186265.aspx

Please keep in mind that such a trace in production enviroment may take quite ammount of space - I personally saw something about 700MB each 30 minutes.

0
 

Author Comment

by:navindba
ID: 35151496
Thank you for the reply.
Is there no way other than doing via server side traces? Just because it is a costly way of doing on production and it will need to run constantly for auditing requirement.
Also why are there so many ‘login success’ entries to the audit file even when I am logged-in once, as described in my original post?
0
 
LVL 14

Accepted Solution

by:
Daniel_PL earned 100 total points
ID: 35151623
It depends on the number of connections, in one of our systems there are many of them so it implies lots of entries captured by trace.
You can use SQL Server auditing, but as you wrote no program name is available :/
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Everyone has problem when going to load data into Data warehouse (EDW). They all need to confirm that data quality is good but they don't no how to proceed. Microsoft has provided new task within SSIS 2008 called "Data Profiler Task". It solve th…
In this article I will describe the Copy Database Wizard method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
Familiarize people with the process of utilizing SQL Server functions from within Microsoft Access. Microsoft Access is a very powerful client/server development tool. One of the SQL Server objects that you can interact with from within Microsoft Ac…
Via a live example, show how to set up a backup for SQL Server using a Maintenance Plan and how to schedule the job into SQL Server Agent.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now