June 26, 2002 at 10:27 am
To meet a security requirement, I created a custom trace to audit certain security events.
Here's the create trace statement
EXEC sp_trace_create @traceid = @tid OUTPUT ,
@options = 6 , @tracefile = N'd:\customTrace\SQLServerSecurityEventAudit'
I then add events to it and to get the trace started I run the stored proc EXEC sp_trace_setstatus @traceid = 1, @status =1
The trace stops and seems to disappear totally (not even showing up as closed) if the box gets rebooted. Is there anyway to configure the trace to automatically start after a reboot?
June 26, 2002 at 11:38 am
You can put it in a proc and mark it as a start up proc. Sp_procoption maybe?
Andy
June 26, 2002 at 12:34 pm
June 26, 2002 at 1:09 pm
Thanks! I made a stored procedure out of the trace create files and used sp_procoption to configure it to execute at startup.
Do you know if the the .trc file the trace writes to will get overwritten or appended to each time there is a restart?
June 26, 2002 at 1:35 pm
Also, in Windows Explorer the .trc file that the trace is writing to shows that the size is 0 until the trace is closed. It even shows size 0 when the trace is paused.
Why is that and is there a way to determine the size of the file while the trace is running?
June 26, 2002 at 1:38 pm
Never thought to check on the trc overwrite, I usually use datetime for the filenames. I think you have to close the file and reopen. Might look at how the rollover functionality works.
Andy
June 26, 2002 at 3:26 pm
The trace is set for trace file rollover.
After a restart or a manual closing of the trace, if the file name in the stored procedure is already existing then the trace will not start. If I enter a different filename in the stored procedure then the trace gets created
Hope this doesn't sound dumb but how do you use datetime for filenames? Do you use a function to get the time and use it as the filename?
Viewing 7 posts - 1 through 6 (of 6 total)
You must be logged in to reply to this topic. Login to reply