Profiler: should the audit login and audit logout always match in a profiler

Question

Profiler: should the audit login and audit logout always match in a profiler

Pyman

SSChampion

Points: 13830
More actions
March 1, 2012 at 12:31 pm

#269340

Hi all,
I ran a trace this morning to see how many users are hitting a specific database, Based on the distinct spids and database name I was able to identify the number of connections..but the audit login and audit logouts dont match...should they always match?
thanks for ur help
“If your actions inspire others to dream more, learn more, do more and become more, you are a leader.” -- John Quincy Adams

Viewing 6 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic. Login to reply

SQL ORACLE One Orange Chip Points: 27807 More actions · Answer 1

I do not think so. You only monitored the numbers of logins and logoffs in your time frame. I cannot see the reasons why they should be the same.

Pyman SSChampion Points: 13830 More actions · Answer 2

But if they dont match does it mean the connections are still open by the end of my trace? The question came up because the dev team wanted to identify the number of user connections for a specific testing and I ran a profiler to identify the connections...and then the dev team tells me that they did a test and want to trace the number of user connections later...so I ran a profiler and saved it too

All I did was run the following queries on the first trace:

select distinct(SPID) from ::fn_trace_gettable('C:\trace1.trc',1) where DatabaseName='abc'--12 unique spids

select distinct(SPID) from ::fn_trace_gettable('C:\trace1.trc',1) where DatabaseName='def'--9 unique spids

and then after their test I ran the profiler again and named it trace2 and ran the following queries

select distinct(SPID) from ::fn_trace_gettable('C:\trace2.trc',1) where DatabaseName='abc'--9 unique spids

select distinct(SPID) from ::fn_trace_gettable('C:\trace2.trc',1) where DatabaseName='def'--8 unique spids

so part of their debugging they are asking me should the audit login and logout events match because here inmy case the audit logins are 2999 and audit logouts are 65

so I was wondering if they shd always match..

thanks

“If your actions inspire others to dream more, learn more, do more and become more, you are a leader.” -- John Quincy Adams

Elliott Whitlow SSC Guru Points: 102402 More actions · Answer 3

Always is a strong word, so I'm going to say no. Over a long period of time they will probably be close, but any session remaining open when the trace closes would throw the counts off.

CEWII

Jared SSC Guru Points: 61793 More actions · Answer 4

Elliott Whitlow (3/1/2012)
Always is a strong word, so I'm going to say no. Over a long period of time they will probably be close, but any session remaining open when the trace closes would throw the counts off.
CEWII

Not to mention any sessions that started BEFORE the trace that ended when the trace was running.

Jared
CE - Microsoft

Elliott Whitlow SSC Guru Points: 102402 More actions · Answer 5

SQLKnowItAll (3/1/2012)
Elliott Whitlow (3/1/2012)
Always is a strong word, so I'm going to say no. Over a long period of time they will probably be close, but any session remaining open when the trace closes would throw the counts off.
CEWII
Not to mention any sessions that started BEFORE the trace that ended when the trace was running.

Also a good point.. I can't even get my SQL Audit Login/Out counts to match and those audits start about as early as possible and end about as late as possible. So with a trace.. Good luck..

CEWII