Post reply

Trace login created or dropped event

  • November 19, 2012 at 3:54 pm

    #265014

    Hi All,

    I have been trying to findout the logins that were created or dropped in past few days. I queried the default trace. I queried on the event calss 'Audit Addlogin Event Class'. But it does not return any values. Can any one tell me what IU am doing wrong. Below is the query I used.

    declare @path varchar(255)

    SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'

    FROM sys.traces

    SELECT

    TE.name As EventClassDescrip, T.EventClass,T.*

    FROM ::fn_trace_gettable(@path, default) T

    INNER JOIN sys.trace_events TE ON T.EventClass = TE.trace_event_id

    WHERE EventClass = 104

  • November 19, 2012 at 10:14 pm

    #1560605

    http://msdn.microsoft.com/en-us/library/ms188228.aspx

  • November 22, 2012 at 12:44 am

    #1561511

    The only thing I see you are missing is the check for is_default. If you have any other traces running on the instance you may be picking up that one. Try this:

    DECLARE @path NVARCHAR(260);

    SELECT @path = REVERSE(SUBSTRING(REVERSE([path]), CHARINDEX('\', REVERSE([path])), 260)) + N'log.trc'

    FROM sys.traces

    WHERE is_default = 1;

    SELECT *

    FROM sys.fn_trace_gettable(@path, DEFAULT) t

    LEFT JOIN sys.trace_events te ON t.EventClass = te.trace_event_id

    WHERE t.EventClass = 104

    ORDER BY StartTime DESC;

    There are no special teachers of virtue, because virtue is taught by the whole community.
    --Plato

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply