SQL Server Forums
Profile | Register | Active Topics | Members | Search | Forum FAQ
 
Register Now and get your question answered!
Username:
Password:
Save Password
Forgot your Password?

 All Forums
 SQL Server 2012 Forums
 SQL Server Administration (2012)
 Alter message of SQL Server Audit to Windows Log
 New Topic  Reply to Topic
 Printer Friendly
Author Previous Topic Topic Next Topic  

asqldeveloper
Starting Member

17 Posts

Posted - 09/03/2013 :  14:07:54  Show Profile  Reply with Quote
I know that we can write Audit events to both file and Windows Event Log.

I know that a typical message in the event log is as shown
(only part of log shown)
Audit event: event_time:2013-09-03 17:40:27.7700000
sequence_number:1
action_id:LGIS
succeeded:true
is_column_permission:false
session_id:59
server_principal_id:2
database_principal_id:0
target_server_principal_id:0
target_database_principal_id:0
object_id:0
user_defined_event_id:0
class_type:LX
statement:-- network protocol: TCP/IP

Couple of questions:

1. Can I customize how this event is written to security log?

Here is why, if you see the action_id is LGIS. If I query the sys.dm_audit_actions it means Login Succeeded. Instead I want the action description to be written as "Login Succeeded" which is more meaningful.

2. Where can I find a description of what the headers mean? For example I want to know what class_type means?

I really would love to customize the message written to event log so that I can give more valuable information especially the "Statement".

Any quick feedback is much appreciated.
  Previous Topic Topic Next Topic  
 New Topic  Reply to Topic
 Printer Friendly
Jump To:
SQL Server Forums © 2000-2009 SQLTeam Publishing, LLC Go To Top Of Page
This page was generated in 0.06 seconds. Powered By: Snitz Forums 2000