Solved

SQL Logon/Logoff Auditing/Trigger?

Posted on 2014-12-01
6
527 Views
Last Modified: 2014-12-01
Hello, I need some help coming up with the best method for checking user activity on our SQL Server.  I know I can enable server audits and such but I need a method that gives me all the information I want and does not hurt performance.

I don't need to audit select statements but I just need to know, what account logged in, what database they logged into, when they logged in and possibly when they logged out.   Other stuff like the hostname, what program they were using is helpful but not required.  My main target is trying to get the database they accessed.

Do any of you have a good procedure/trigger for this or is there a good way to configure the audit profiles?  I did some research but was a bit fuzzy with the built in SQL stuff.
0
Comment
Question by:Roxanne25
  • 2
  • 2
  • 2
6 Comments
 
LVL 69

Expert Comment

by:Scott Pletcher
ID: 40473993
You can use a standard "FOR LOGON" trigger to do all of that except capturing logging out.  You would probably need to use extended events to capture the logout activity.
0
 
LVL 24

Accepted Solution

by:
Phillip Burton earned 500 total points
ID: 40473995
By "I can enable server audits", do you mean right-hand clicking on the Server instance, go to Properties, go to Security and enable Login auditing?

If you want more than that, you do need to configure Database Audit Specifications etc. See http://msdn.microsoft.com/en-GB/library/cc280386.aspx for more information.
0
 
LVL 24

Assisted Solution

by:Phillip Burton
Phillip Burton earned 500 total points
ID: 40474000
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 69

Expert Comment

by:Scott Pletcher
ID: 40474014
Here's the shell for creating a logon trigger.  A logon trigger is synchronous, i.e., the trigger processing occurs before the logon completes.  Still, a properly-written trigger won't noticeably slow things down unless there are extremely large numbers of logons.

Event notifications are async and thus would not slow down logon.

Here's the basic, setup code for a logon trigger:

CREATE TRIGGER [Server_Trigger_Logon]
ON ALL SERVER
--WITH EXECUTE AS 'sa' --don't want to do this as we will lose original caller's info
AFTER LOGON
AS

INSERT INTO dbo.login_history ( login, login_datetime2, ... )
SELECT ORIGINAL_LOGIN(), SYSDATETIME, ...
--WHERE ORIGINAL_LOGIN() NOT IN (...list of logins to exclude from logging...)
0
 

Author Comment

by:Roxanne25
ID: 40474230
@Phillip:

I took your advise with the database audit specification... but it doesn't work.  I'm trying to be more granular with it and do "select" as the audit type and then specify specific users and schemas I want audited...but when I do this nothing gets inserted into the log.  If I do the Schema_Object_Access_Group then it does work and captures stuff...but of course then it will log every little darned thing from every user...and I don't want the log getting clogged up with stuff I don't need.

Do you know why the "select" type won't work?
0
 

Author Comment

by:Roxanne25
ID: 40474395
Nevermind, I figured it out... it didn't seem to like me putting multiple principals on the same line.  Once I separated each principal I wanted to audit into separate lines, it worked fine.  Thanks for the help!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article I will describe the Backup & Restore method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
This article explains how to reset the password of the sa account on a Microsoft SQL Server.  The steps in this article work in SQL 2005, 2008, 2008 R2, 2012, 2014 and 2016.
This video shows, step by step, how to configure Oracle Heterogeneous Services via the Generic Gateway Agent in order to make a connection from an Oracle session and access a remote SQL Server database table.
Using examples as well as descriptions, and references to Books Online, show the documentation available for datatypes, explain the available data types and show how data can be passed into and out of variables.

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now