Posted - 09/03/2013 : 14:07:54
| I know that we can write Audit events to both file and Windows Event Log.
I know that a typical message in the event log is as shown
(only part of log shown)
Audit event: event_time:2013-09-03 17:40:27.7700000
statement:-- network protocol: TCP/IP
Couple of questions:
1. Can I customize how this event is written to security log?
Here is why, if you see the action_id is LGIS. If I query the sys.dm_audit_actions it means Login Succeeded. Instead I want the action description to be written as "Login Succeeded" which is more meaningful.
2. Where can I find a description of what the headers mean? For example I want to know what class_type means?
I really would love to customize the message written to event log so that I can give more valuable information especially the "Statement".
Any quick feedback is much appreciated.