<_locDefinition> <_locDefault _loc="locNone" /> <_locTag _loc="locData">DESCRIPTION Microsoft SQL Server 7 0 0 RTM Security Audit Collection of database audit event classes. 14 Audit Login Collects all new connection events since the trace was started, such as when a client requests a connection to a server running an instance of SQL Server. 1 2 3 6 7 8 9 10 11 12 14 26 15 Audit Logout Collects all new disconnect events since the trace was started, such as when a client issues a disconnect command. 3 6 7 8 9 10 11 12 13 14 15 16 17 18 26 18 Audit Server Starts And Stops Records service shut down, start, and pause activities. 3 6 7 8 9 10 11 12 14 21 1 Shutdown 2 Started 3 Paused 4 Continue 26 20 Audit Login Failed Indicates that a login attempt to SQL Server from a client failed. 1 3 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 26 Cursors Collection of events produced when cursors are created, used and deleted. 53 CursorOpen Indicates when a cursor has been opened on an SQL statement by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 25 26 70 CursorPrepare Indicates when a cursor on an SQL statement has been prepared for use by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 74 CursorExecute Indicates when a prepared cursor on an SQL statement has been executed by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 25 26 75 CursorRecompile Indicates when a cursor on an SQL statement has been recompiled either intentionally or due to a schema change or other event. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 76 CursorImplicitConversion Indicates when a cursor on an SQL statement has been converted by SQL Server from one type to another. 2 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 25 26 77 CursorUnprepare Indicates when a prepared cursor on an SQL statement has been unprepared by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 78 CursorClose Indicates when a cursor on an SQL statement has been closed by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 Errors and Warnings 2 Collection of event classes that are produced when a SQL Server error or warning occurs (for example, an error during the compilation of a stored procedure, or an exception in SQL Server). 16 Attention Collects all attention events, such as client interrupt request or when a client connection is broken. 3 6 7 8 9 10 11 12 14 15 18 21 0 Recursion 1 Bailout 26 21 EventLog Indicates events logged in the Windows application event log. 1 3 6 7 8 9 10 11 12 14 20 21 0 Recursion 1 Bailout 26 22 ErrorLog Indicates error events logged in the SQL Server error log. 1 3 6 7 8 9 10 11 12 14 20 21 0 Recursion 1 Bailout 26 33 Exception Indicates that an exception has occurred in SQL Server. 3 6 7 8 9 10 11 12 14 20 21 0 Recursion 1 Bailout 26 55 Hash Warning Indicates that a hashing operation may have incurred a problem. 3 6 7 8 9 10 11 12 13 14 15 16 21 0 Recursion 1 Bailout 22 25 26 61 OLEDB Errors Indicates that an OLE DB error has occurred. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 67 Execution Warnings Indicates any warnings that occurred during the execution of a SQL Server statement or stored procedure. 3 6 7 8 9 10 11 12 14 21 1 Query wait 2 Query timeout 3 Indexed views loaded 26 69 Sort Warnings Indicates sort operations that do not fit into memory. Does not include sort operations involving the creation of indexes, only sort operations within a query (such as an ORDER BY clause used in a SELECT statement). 3 6 7 8 9 10 11 12 14 21 1 Single pass 2 Multiple pass 26 79 Missing Column Statistics Indicates that column statistics which would have been useful to the query optimizer are not present. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 80 Missing Join Predicate Indicates that a predicate joining two tables is not present. This can potentially result in long-running queries or inaccurate results. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 Locks Collection of database object locking event classes. 23 Lock:Released Indicates that a lock on a resource, such as a page, has been released. 2 3 4 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 24 26 24 Lock:Acquired Indicates acquisition of a lock on a resource, such as a data page. 2 3 4 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 24 26 25 Lock:Deadlock Indicates that two concurrent transactions have deadlocked each other by trying to obtain incompatible locks on resources the other transaction owns. 2 3 4 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 24 25 26 26 Lock:Cancel Indicates that the acquisition of a lock on a resource has been canceled (for example, due to a deadlock). 2 3 4 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 24 25 26 27 Lock:Timeout Indicates that a request for a lock on a resource, such as a page, has timed out due to another transaction holding a blocking lock on the required resource. 2 3 4 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 24 25 26 59 Lock:Deadlock Chain Is produced for each of the events leading up to the deadlock. 2 3 4 6 7 8 9 10 11 12 13 14 21 101 Resource type Lock 102 Resource type Exchange 103 Resource type Thread 104 Resource type Page Support 22 25 26 60 Lock:Escalation A finer-grained lock has been converted to a coarser-grained lock. 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 24 26 Objects Collection of event classes that are produced when database objects are created, opened, closed, dropped, or deleted. 46 Object:Created Indicates when an object has been created, such as for CREATE INDEX, CREATE TABLE, and CREATE DATABASE statements. 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 24 26 47 Object:Deleted Indicates when an object has been deleted, such as in DROP INDEX and DROP TABLE statements. 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 24 26 48 Object:Opened Indicates when an object has been accessed, such as for SELECT, INSERT, or DELETE statements. 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 24 26 49 Object:Closed Indicates when an open object has been closed, such as at the end of a SELECT, INSERT, or DELETE statement. 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 24 26 58 Auto Stats Collects the events associated with the automatic creation and updating of statistics. 1 3 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 25 26 Performance Collection of showplan event classes and event classes that are produced from the execution of SQL data manipulation language (DML) operators. 28 Degree of Parallelism Insert Describes the degree of parallelism assigned to the SQL statement. 2 3 4 6 7 8 9 10 11 12 14 25 26 27 29 Degree of Parallelism Update Describes the degree of parallelism assigned to the SQL statement. 2 3 6 7 8 9 10 11 12 14 25 26 27 30 Degree of Parallelism Delete Describes the degree of parallelism assigned to the SQL statement. 2 3 6 7 8 9 10 11 12 14 25 26 27 31 Degree of Parallelism Select Describes the degree of parallelism assigned to the SQL statement. 2 3 6 7 8 9 10 11 12 14 25 26 27 68 Execution Plan Displays the plan tree of the SQL statement being executed. 1 2 3 4 6 7 8 9 10 11 12 14 25 26 Scans Collection of database object scan event classes. Database objects that can be scanned include tables and indexes. 51 Scan:Started Indicates when a table or index scan has started. 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 24 26 52 Scan:Stopped Indicates when a table or index scan has stopped. 3 4 6 7 8 9 10 11 12 13 14 15 16 21 0 Recursion 1 Bailout 22 24 26 Server Collection of server control and server memory change events. 81 Server Memory Change Indicates when SQL Server memory usage increases or decreases by 1 megabyte or 5% of the maximum server memory, whichever is greater. 3 6 7 8 9 10 11 12 14 21 1 Increase 2 Decrease 25 26 Sessions 1 Collection of event classes that are produced by clients connecting to and disconnecting from SQL Server. 17 ExistingConnection Detects activity by all users connected to SQL Server before the trace was started; otherwise, these existing connections would not be detected by the Connect event class. 1 2 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 Stored Procedures Collection of event classes that are produced by the execution of stored procedures. 10 RPC:Completed Occurs when a remote procedure call has been completed. 1 3 6 7 8 9 10 11 12 13 14 15 16 17 18 21 0 Recursion 1 Bailout 26 11 RPC:Starting Occurs when a remote procedure call has started. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 34 SP:CacheMiss Indicates when a stored procedure is not found in the procedure cache. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 35 SP:CacheInsert Indicates when an item is inserted into the procedure cache. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 26 36 SP:CacheRemove Indicates when an item is removed from the procedure cache. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 26 37 SP:Recompile Indicates that the stored procedure is recompiling. 1 3 6 7 8 9 10 11 12 13 14 15 18 21 0 Recursion 1 Bailout 22 26 38 SP:CacheHit Indicates when a procedure is found in the cache. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 26 39 SP:ExecContextHit Indicates the context of the local state for the executing procedure. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 26 42 SP:Starting Indicates when the stored procedure has started. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 26 43 SP:Completed Indicates when the stored procedure has completed. 1 3 6 7 8 9 10 11 12 13 14 15 21 0 Recursion 1 Bailout 22 26 44 SP:StmtStarting Indicates when a statement within a stored procedure is starting. 1 3 6 7 8 9 10 11 12 14 22 26 27 45 SP:StmtCompleted Indicates when a statement within a stored procedure has completed. 1 3 6 7 8 9 10 11 12 13 14 15 16 17 18 22 25 26 27 Transactions Collection of event classes that are produced by the execution of MS DTC or SQL transactions or by writing to the transaction log. 19 DTCTransaction Tracks MS DTC coordinated transactions between two or more databases. 1 2 3 6 7 8 9 10 11 12 13 14 15 16 17 18 21 17 Transaction is committing 22 TM failed while in prepared state 9 Internal commit 10 Internal abort 6 Creating a new DTC transaction 7 Enlisting in a DTC transaction 3 Close connection 23 Unknown 0 Get address 1 Propagate Transaction 14 Preparing Transaction 15 Transaction is prepared 16 Transaction is aborting 26 50 SQLTransaction Tracks BEGIN TRANSACTION, COMMIT TRANSACTION, SAVE TRANSACTION, and ROLLBACK TRANSACTION statements. 1 3 4 6 7 8 9 10 11 12 13 14 15 21 0 Begin 1 Commit 2 Rollback 3 Savepoint 26 54 TransactionLog Tracks when transaction are written to the transaction log. 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 21 0 Recursion 1 Bailout 22 24 25 26 TSQL Collection of event classes that are produced by the execution of SQL passed to SQL Server from the client. 12 SQL:BatchCompleted Occurs when the Transact-SQL statement has completed. 1 3 6 7 8 9 10 11 12 13 14 15 16 17 18 21 0 Recursion 1 Bailout 26 13 SQL:BatchStarting Occurs when a Transact-SQL batch is starting. 1 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 40 SQL:StmtStarting Occurs when the Transact-SQL statement is starting. 1 3 4 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 22 26 41 SQL:StmtCompleted Occurs when the Transact-SQL statement has completed. 1 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 21 0 Recursion 1 Bailout 22 25 26 71 Prepare SQL Indicates when an SQL statement or statements have been prepared for use by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 72 Exec Prepared SQL Indicates when a prepared SQL statement or statements have been executed by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 73 Unprepare SQL Indicates when a prepared SQL statement or statements have been unprepared by ODBC, OLE DB or DB-Library. 3 6 7 8 9 10 11 12 14 21 0 Recursion 1 Bailout 26 User configurable Collection of user configurable event classes. 82 UserConfigurable:0 Collects event data defined by the user. 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 20 21 0 Recursion 1 Bailout 22 24 25 26 83 UserConfigurable:1 Collects event data defined by the user. 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 20 21 0 Recursion 1 Bailout 22 24 25 26 84 UserConfigurable:2 Collects event data defined by the user. 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 20 21 0 Recursion 1 Bailout 22 24 25 26 85 UserConfigurable:3 Collects event data defined by the user. 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 20 21 0 Recursion 1 Bailout 22 24 25 26 86 UserConfigurable:4 Collects event data defined by the user. 1 2 3 4 6 7 8 9 10 11 12 13 14 15 16 17 18 20 21 0 Recursion 1 Bailout 22 24 25 26 1 9 TextData Text value dependent on the event class captured in the trace. true false false 2 7 BinaryData Binary value dependent on the event class captured in the trace. false false false 3 1 DatabaseID ID of the database specified by the USE database statement, or the default database if no USE database statement has been issued for a given connection. true false false 4 2 TransactionID System-assigned ID of the transaction. false false false 6 8 NTUserName Windows user name. true true false 7 8 NTDomainName Windows domain to which the user belongs. true true false 8 8 HostName Name of the computer on which the client is running. This data column is populated if the host name is provided by the client. To determine the host name, use the HOST_NAME function. true true false 9 1 ClientProcessID The process ID of the application calling SQL Server. true true false 10 8 ApplicationName Name of the client application that created the connection to SQL Server. This column is populated with the values passed by the application rather than the displayed name of the program. true true false 11 8 LoginName Name of the login of the user (either SQL Server security login or the Windows login credentials in the form of DOMAIN\Username). true true false 12 1 SPID Server Process ID assigned by SQL Server to the process associated with the client. true false false 13 2 Duration Amount of time (in milliseconds) taken by the event. true false false 14 6 StartTime Time at which the event started, when available. true false false 15 6 EndTime Time at which the event ended. This column is not populated for starting event classes, such as SQL:BatchStarting or SP:Starting. true false false 16 2 Reads Number of logical disk reads performed by the server on behalf of the event. true false false 17 2 Writes Number of physical disk writes performed by the server on behalf of the event. true false false 18 1 CPU Amount of CPU time (in milliseconds) used by the event. true false false 19 1 Permissions Integer value representing the type of permissions checked. true false false 20 1 Severity Severity level of an exception. true false false 21 1 EventSubClass Type of event subclass. This data column is not populated for all event classes. false false false 22 1 ObjectID System-assigned ID of the object. true false false 23 1 Success 1 = success. 0 = failure (for example, a 1 means success of a permissions check and a 2 means a failure of that check). true false false 24 1 IndexID ID for the index on the object affected by the event. To determine the index ID for an object, use the indid column of the sysindexes system table. true false false 25 1 IntegerData Integer value dependent on the event class captured in the trace. false false false 26 8 ServerName Name of the SQL Server traced. false true false 27 8 EventClass Event class name. false true false 28 1 ObjectType Value representing the type of the object involved in the event. This value corresponds to the type column in sysobjects. true false false 29 1 NestLevel Integer representing the data returned by @@NESTLEVEL. false false false 30 1 State Equivalent to an error state code. true false false 31 1 Error Error number of a given event. Often this is the error number stored in sysmessages. true false false 32 1 Mode Integer used by various events to describe a state the event has received or is requesting. true false false 33 1 Handle Integer used by ODBC, OLE DB, or DB-Library to coordinate execution with the server. true false false 34 8 ObjectName The name of the object being referenced. true false false 35 8 DatabaseName Name of the database in which the statement of the user is running. true false false 36 8 FileName The logical name of the file being modified. true false false 37 8 OwnerName Database user name of the object owner. true false false 38 8 RoleName Name of an application role being enabled. true false false 39 8 TargetUserName For actions which target a database user (for instance, granting permission to a user), the name of that user. true false false 40 8 DBUserName SQL Server user name of the client. true false false 41 7 LoginSid Security identification number (SID) of the logged-in user. You can find this information in the syslogins table of the master database. Each SID is unique for each login in the server. false true false 42 8 TargetLoginName For actions which target a login (for instance, adding a new login), the name of the targeted login. true false false 43 7 TargetLoginSid For actions which target a login (for instance, adding a new login), the security identification number (SID) of the targeted login. false false false 44 1 ColumnPermissions Indicator of whether a column permission was set. Parse the statement text to determine exactly which permissions were applied to which columns. true false false