<_locDefinition> <_locDefault _loc="locNone" /> <_locTag _loc="locData">DESCRIPTION <_locTag _loc="locData">BESTPRACTICE Security Audit Collection of database audit event classes. 53 Indicates when a cursor has been opened on an SQL statement by ODBC, OLE DB or DB-Library. 70 Indicates when a cursor on an SQL statement has been prepared for use by ODBC, OLE DB or DB-Library. 74 Indicates when a prepared cursor on an SQL statement has been executed by ODBC, OLE DB or DB-Library. 75 Indicates when a cursor on an SQL statement has been recompiled either intentionally or due to a schema change or other event. 76 Indicates when a cursor on an SQL statement has been converted by SQL Server from one type to another. 77 Indicates when a prepared cursor on an SQL statement has been unprepared by ODBC, OLE DB or DB-Library. 78 Indicates when a cursor on an SQL statement has been closed by ODBC, OLE DB or DB-Library. 92 Indicates that the data file grew automatically. This event does not get triggered if the data file is grown explicitly through alter database. 93 Indicates that the log file grows automatically. This event does not get triggered if the log file is grown explicitly through alter database. 94 Indicates that the data file has been shrunk. 95 Indicates that the log file has been shrunk. 79 Indicates that column statistics which would have been useful to the query optimizer are not present. 80 Indicates that a predicate joining two tables is not present. This can potentially result in long-running queries or inaccurate results. 69 Indicates sort operations that do not fit into memory. Does not include sort operations involving the creation of indexes, only sort operations within a query (such as an ORDER BY clause used in a SELECT statement). 67 Indicates any warnings that occurred during the execution of a SQL Server statement or stored procedure. 55 Indicates that a hashing operation may have incurred a problem. 16 Collects all attention events, such as client interrupt request or when a client connection is broken. 21 Indicates events logged in the Windows application event log. 22 Indicates error events logged in the SQL Server error log. 33 Indicates that an exception has occurred in SQL Server. 26 Indicates that the acquisition of a lock on a resource has been canceled (for example, due to a deadlock). 27 Indicates that a request for a lock on a resource, such as a page, has timed out due to another transaction holding a blocking lock on the required resource. 23 Indicates that a lock on a resource, such as a page, has been released. 24 Indicates acquisition of a lock on a resource, such as a data page. 25 Indicates that two concurrent transactions have deadlocked each other by trying to obtain incompatible locks on resources the other transaction owns. 59 Is produced for each of the events leading up to the deadlock. 60 A finer-grained lock has been converted to a coarser-grained lock. 58 Collects the events associated with the automatic creation and updating of statistics. 46 Indicates when an object has been created, such as for CREATE INDEX, CREATE TABLE, and CREATE DATABASE statements. 47 Indicates when an object has been deleted, such as in DROP INDEX and DROP TABLE statements. 68 Displays the plan tree of the SQL statement being executed. 28 Describes the degree of parallelism assigned to the SQL statement. 96 Displays the query-plan tree of the SQL statement being executed. 97 Displays the query-plan with full compile-time details (including costing estimates and column lists) of the SQL statement being executed. 98 Displays the query-plan with full run-time details (including actual number of rows passing through each operation) of the SQL statement, which was executed. 122 No Description. 123 Displays performance information about individual Full-Text queries, including the query itself, the number of rows returned, and the duration of the query. 51 Indicates when a table or index scan has started. 52 Indicates when a table or index scan has stopped. 20 Indicates that a login attempt to SQL Server from a client failed. 18 Records service shut down, start, and pause activities. 14 Collects all new connection events since the trace was started, such as when a client requests a connection to a server running an instance of SQL Server. 15 Collects all new disconnect events since the trace was started, such as when a client issues a disconnect command. 102 Records GRANT, DENY, REVOKE statement permission events. 103 Records GRANT, DENY, REVOKE object permission events. 104 Records add and drop actions on SQL Server logins for sp_addlogin and sp_droplogin. 105 Records grant, revoke, and deny actions on Windows account login rights for sp_grantlogin, sp_revokelogin, and sp_denylogin. 106 Records modifications on login property, except passwords, for sp_defaultdb and sp_default language. 107 Records SQL Server login password changes. Passwords are not recorded. 108 Records addition or removal of logins to a fixed server role for sp_addsrvrolemember and sp_dropsrvrolemember. 109 Records addition and removal of database users (Windows or SQL Server). 110 Records addition and removal of members to a database role (fixed or user-defined) for sp_addrolemember, sp_droprolemember, and sp_changegroup. 111 Records add or drop actions on database roles for sp_addrole and sp_droprole. 112 Records changes on the password of an application. 113 Records use of statement permissions. 114 Records use of object permissions, successfully or unsuccessfully. 115 Records BACKUP and RESTORE events. 116 Records DBCC commands issued. 117 Records AUDIT modifications. 118 Records when a CREATE, ALTER, or DROP command is issued for the specified object. 81 Indicates when SQL Server memory usage increases or decreases by 1 megabyte or 5% of the maximum server memory, whichever is greater. 17 Detects activity by all users connected to SQL Server before the trace was started; otherwise, these existing connections would not be detected by the Connect event class. 10 Occurs when a remote procedure call has been completed. 11 Occurs when a remote procedure call has started. 34 Indicates when a stored procedure is not found in the procedure cache. 35 Indicates when an item is inserted into the procedure cache. 36 Indicates when an item is removed from the procedure cache. 37 Indicates that the stored procedure is recompiling. 38 Indicates when a procedure is found in the cache. 39 Indicates the context of the local state for the executing procedure. 42 Indicates when the stored procedure has started. 43 Indicates when the stored procedure has completed. 44 No Description. 45 No Description. 100 Information about output parameters of previously executed remote procedure call. 19 Tracks MS DTC coordinated transactions between two or more databases. 54 Tracks when transaction are written to the transaction log. 50 Tracks BEGIN TRANSACTION, COMMIT TRANSACTION, SAVE TRANSACTION, and ROLLBACK TRANSACTION statements. 73 Indicates when a prepared SQL statement or statements have been unprepared by ODBC, OLE DB or DB-Library. 71 Indicates when an SQL statement or statements have been prepared for use by ODBC, OLE DB or DB-Library. 72 Indicates when a prepared SQL statement or statements have been executed by ODBC, OLE DB or DB-Library. 12 Occurs when the Transact-SQL statement has completed. 13 Occurs when a Transact-SQL batch is starting. 40 Occurs when the Transact-SQL statement is starting. 41 Occurs when the Transact-SQL statement has completed. 82 Collects event data defined by the user. 83 Collects event data defined by the user. 84 Collects event data defined by the user. 85 Collects event data defined by the user. 86 Collects event data defined by the user. 91 Collects event data defined by the user. 87 Collects event data defined by the user. 88 Collects event data defined by the user. 89 Collects event data defined by the user. 90 Collects event data defined by the user. 119 Displays OLE DB provider calls made by SQL Server for distributed queries and remote stored procedures. 120 Displays OLE DB IUnknown::QueryInterface calls made by SQL Server for distributed queries and remote stored procedures. 121 Displays OLE DB IRowset::GetData calls made by SQL Server for fetching row data for distributed queries and remote stored procedures. 61 Indicates that an OLE DB error has occurred. 1 Text value dependent on the event class captured in the trace. 2 Binary value dependent on the event class captured in the trace. 3 ID of the database specified by the USE database statement, or the default database if no USE database statement has been issued for a given connection. 4 System-assigned ID of the transaction. 6 Windows user name. 7 Windows domain to which the user belongs. 8 Name of the computer on which the client is running. This data column is populated if the host name is provided by the client. To determine the host name, use the HOST_NAME function. 9 The process ID of the application calling SQL Server. 10 Name of the client application that created the connection to SQL Server. This column is populated with the values passed by the application rather than the displayed name of the program. 11 Name of the login of the user (either SQL Server security login or the Windows login credentials in the form of DOMAIN\Username). 12 Server Process ID assigned by SQL Server to the process associated with the client. 13 Amount of time (in milliseconds) taken by the event. 14 Time at which the event started, when available. 15 Time at which the event ended. This column is not populated for starting event classes, such as SQL:BatchStarting or SP:Starting. 16 Number of logical disk reads performed by the server on behalf of the event. 17 Number of physical disk writes performed by the server on behalf of the event. 18 Amount of CPU time (in milliseconds) used by the event. 19 Integer value representing the type of permissions checked. 20 Severity level of an exception. 21 Type of event subclass. This data column is not populated for all event classes. 22 System-assigned ID of the object. 23 1 = success. 0 = failure (for example, a 1 means success of a permissions check and a 0 means a failure of that check). 24 ID for the index on the object affected by the event. To determine the index ID for an object, use the indid column of the sysindexes system table. 25 Integer value dependent on the event class captured in the trace. 26 Name of the SQL Server traced. 27 Event class name. 28 Value representing the type of the object involved in the event. This value corresponds to the type column in sysobjects. 29 Integer representing the data returned by @@NESTLEVEL. 30 Equivalent to an error state code. 31 Error number of a given event. Often this is the error number stored in sysmessages. 32 Integer used by various events to describe a state the event has received or is requesting. 33 Integer used by ODBC, OLE DB, or DB-Library to coordinate execution with the server. 34 The name of the object being referenced. 35 Name of the database in which the statement of the user is running. 36 The logical name of the file being modified. 37 Database user name of the object owner. 38 Name of an application role being enabled. 39 For actions which target a database user (for instance, granting permission to a user), the name of that user. 40 SQL Server user name of the client. 41 Security identification number (SID) of the logged-in user. You can find this information in the syslogins table of the master database. Each SID is unique for each login in the server. 42 For actions which target a login (for instance, adding a new login), the name of the targeted login. 43 For actions which target a login (for instance, adding a new login), the security identification number (SID) of the targeted login. 44 Indicator of whether a column permission was set. Parse the statement text to determine exactly which permissions were applied to which columns. 45 Name of the linked server. 46 Name of the OLE DB provider. 47 Name of the OLE DB method. 48 No description 49 No description 50 No description