application_name is not available in audit logs in SQL Server 2017

  • I am looking for a way to fetch client application name in audit logs in SQL Server. As per the MSDN page, it should be available from SQL Server 2017 on-wards.

    https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql

    I have created a database level audit specification for select and insert and I want to determine which application is executing those queries.

    Any help around this topic is appreciated.

  • ajeet.s.chouhan - Tuesday, December 5, 2017 11:47 PM

    I am looking for a way to fetch client application name in audit logs in SQL Server. As per the MSDN page, it should be available from SQL Server 2017 on-wards.

    https://docs.microsoft.com/en-us/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql

    I have created a database level audit specification for select and insert and I want to determine which application is executing those queries.

    Any help around this topic is appreciated.

    Are you querying the log using sys.fn_get_audit_file or are you trying to do the View Audit Logs in SSMS?
    Use the query - using SSMS has different issues and can be problematic.

    Sue

  • Hello Sue

    Yes, I was trying to view it in SSMS. The query works fine and it returns the correct data.

  • Keep in mind that application name can be pretty easily spoofed. It's set by the connecting application.

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply