How to find if someone ran SQL profiler 2 days back

Question

Post reply

How to find if someone ran SQL profiler 2 days back

gary1

SSC-Insane

Points: 21152
More actions
March 13, 2018 at 3:43 pm

#403171

Hi
Is there a way we can find if someone ran SQL profiler 2 days back?

Viewing 10 posts - 1 through 9 (of 9 total)

You must be logged in to reply to this topic. Login to reply

Jeff Moden SSC Guru Points: 1004312 More actions · Answer 1

gary1 - Tuesday, March 13, 2018 3:43 PM
Hi
Is there a way we can find if someone ran SQL profiler 2 days back?

Not likely.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

Gail Shaw SSC Guru Points: 1004504 More actions · Answer 2

Short of asking people, no.

Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass

Eirikur Eiriksson SSC Guru Points: 182911 More actions · Answer 3

gary1 - Tuesday, March 13, 2018 3:43 PM
Hi
Is there a way we can find if someone ran SQL profiler 2 days back?

Hmmm! you don't know if the profiler was run nor who might have possibly done so? Somehow I thing you have a bigger problem on your hands.
😎
May I ask what is the reason for this, were there performance problems?

Sue_H SSC Guru Points: 90860 More actions · Answer 4

gary1 - Tuesday, March 13, 2018 3:43 PM
Hi
Is there a way we can find if someone ran SQL profiler 2 days back?

If you still have default traces from that time, it would be in there.
Event class would be Audit Server Alter Trace Event. You'd look for exec sp_trace_create in the text data. Application name would be SQL Server Profiler - xxxxxxx

Sue

Jeffery Williams SSCertifiable Points: 6441 More actions · Answer 5

Eirikur Eiriksson - Wednesday, March 14, 2018 5:30 AM
gary1 - Tuesday, March 13, 2018 3:43 PM
Hi
Is there a way we can find if someone ran SQL profiler 2 days back?
Hmmm! you don't know if the profiler was run nor who might have possibly done so? Somehow I thing you have a bigger problem on your hands.
😎
May I ask what is the reason for this, were there performance problems?

True that!

<hr noshade size=1 width=250 color=#BBC8E5> Regards,Jeffery Williams http://www.linkedin.com/in/jwilliamsoh

Jeffery Williams SSCertifiable Points: 6441 More actions · Answer 6

gary1 - Tuesday, March 13, 2018 3:43 PM
Hi
Is there a way we can find if someone ran SQL profiler 2 days back?

How many people have sufficient rights to run profiler? This gives a pretty granular (perhaps in the wrong hands dangerous look) at your environment.

<hr noshade size=1 width=250 color=#BBC8E5> Regards,Jeffery Williams http://www.linkedin.com/in/jwilliamsoh

Enterprise DBA SSC-Addicted Points: 478 More actions · Answer 7

Gary1,

Traces started by Profiler are recorded in the errorlog. sp_readerrorlog 0, 1, ‘trace’.

Perry Whittle SSC Guru Points: 234013 More actions · Answer 8

gary1 - Tuesday, March 13, 2018 3:43 PM
Hi
Is there a way we can find if someone ran SQL profiler 2 days back?

the sql error log will record a trace start and trace stop event with the trace id and the user id who initiated it

-----------------------------------------------------------------------------------------------------------

"Ya can't make an omelette without breaking just a few eggs" 😉

Jeff Moden SSC Guru Points: 1004312 More actions · Answer 9

Perry Whittle - Thursday, March 15, 2018 6:00 AM
the sql error log will record a trace start and trace stop event with the trace id and the user id who initiated it

Enterprise DBA - Wednesday, March 14, 2018 3:16 PM
Gary1,Traces started by Profiler are recorded in the errorlog. sp_readerrorlog 0, 1, â€˜traceâ€™.

Thank you both for that. Learned something new.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)