Filter a SQL Server Audit with a predicate

• michal.lisinski

  SSCertifiable

  Points: 7201

  More actions

  December 13, 2024 at 10:46 am

  #4497711

  Hi Gents,

  Silly question, but it's been a long time since I've done this. I need an audit of all successful and failed login attempts, so I created an Audit, but I don't want to log everything, so I added a filter:

  WHERE ([action_id]=(538990668))

  based on https://techcommunity.microsoft.com/blog/sqlserver/filter-sql-server-audit-on-action-id--class-type-predicate/384140

  SELECT [class_type]
   FROM sys.dm_audit_class_type_map
  WHERE [class_type_desc] = 'LOGIN';
  
  SELECT dbo.GetInt_action_id ('LX') AS Int_Action_Id;

  But it doesn't record any new events. Have I messed something up?

  • This topic was modified 1 week, 1 day ago by  michal.lisinski.

• michal.lisinski

  SSCertifiable

  Points: 7201

  More actions

  December 13, 2024 at 10:48 am

  #4497712

  Sorry, should be:

  SELECT [class_type]
   FROM sys.dm_audit_class_type_map
  WHERE [class_type_desc] = 'LOGIN';