March 23, 2007 at 1:57 pm
I would like to enable the SQL login auditing but I do not want to touch the Application Event Viewer Log. The Event Log on my server is completely filled up with auditing info, makes it very hard -almost impossible- to track any other events. Is there a way to achieve this?
By default, SQL Server writes all day-to-day operations including startup, shutdown, backups, server-side traces, audit login activity to the Windows Application log. I also see these info written in the SQL Error Logs in the SQL Server folder. Are these two the same?
Thank you.
March 24, 2007 at 10:35 am
Then use sql trace/profile to do auditing....
What kind of auding you want to do?
MohammedU
Microsoft SQL Server MVP
March 24, 2007 at 11:09 am
For starter, I want to know who and when some one logs in the database. The the built-in SQL security auditing does just that (logins success/failure) but I want the results to be written in my own log file, NOT in the system Application Event Viewr log.
Thanks,
March 24, 2007 at 12:47 pm
It should also write to the SQL Server error log. But if you want it completely separate, as has been previously mentioned, use a SQL trace / Profiler. If it's a permanent thing, you can create a startup stored procedure which automatically starts up the trace every time SQL Server is restarted.
K. Brian Kelley
@kbriankelley
March 26, 2007 at 4:46 am
you could start sqlserver with the -n flag, then sql server events (ANYof them) are not posted to the windows application log
---------------------------------------------------------------------
March 26, 2007 at 7:49 am
Thank you all for the info.
George et al, to use the -n flag, do I have to create a new key in the registry? for example, SQLArg3 with value -n? Thanks.
March 26, 2007 at 7:57 am
no need to update registry, put it in startup paramaters via enterprise manager along (right click server, properties) with the -e, id, -i. Just add another entry -n
if you start from a comamnd line just add -n parameter to sqlserver.exe command
please be aware this stops all sql server events logging in the windows application log , leaving logging in sql errorlog only. See BOL
---------------------------------------------------------------------
March 26, 2007 at 8:11 am
G, thank you very much.
March 26, 2007 at 8:14 am
a little detail: does the server need a reboot? or just a SQL Server service restart is enough? Thnaks.
March 26, 2007 at 8:30 am
Event logs have lots of filters. You should be able to move out the SQL Login events easily.
Viewing 10 posts - 1 through 9 (of 9 total)
You must be logged in to reply to this topic. Login to reply