Skip Headers
Oracle® Audit Vault Auditor's Guide
Release 10.3

Part Number E16813-02
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

B Microsoft SQL Server Audit Events

This appendix contains:

B.1 About the Microsoft SQL Server Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Microsoft SQL Server. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

B.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as adding logins or changing login passwords. The Account Management Report, described in Section 3.3.3.2, uses these events.

Table B-1 lists the Microsoft SQL Server account management source database events and the equivalent Oracle Audit Vault events.

Table B-1 SQL Server Account Management Audit Events

Event Name Description Source Event Audit Vault Event

Audit AddLogin Event

ADDLOGIN:ADD

ADDLOGIN:DROP

CREATE USER

DROP USER

Audit Database Principal Management Event

DATABASE PRINCIPAL MANAGEMENT:ALTER: USER

DATABASE PRINCIPAL MANAGEMENT:CREATE: USER

DATABASE PRINCIPAL MANAGEMENT:DROP: USER

ALTER USER

CREATE USER

DROP USER

Audit Login Change Password Event

LOGIN CHANGE PASSWORD:PASSWORD CHANGED

LOGIN CHANGE PASSWORD:PASSWORD MUST CHANGE

LOGIN CHANGE PASSWORD:PASSWORD RESET

LOGIN CHANGE PASSWORD:PASSWORD SELF CHANGED

LOGIN CHANGE PASSWORD:PASSWORD SELF RESET

LOGIN CHANGE PASSWORD:PASSWORD UNLOCKED

ALTER USER

ALTER USER

ALTER USER

ALTER USER

ALTER USER

ALTER USER

Audit Login Change Property Event

LOGIN CHANGE PROPERTY:CREDENTIAL CHANGED

LOGIN CHANGE PROPERTY:DEFAULT DATABASE

LOGIN CHANGE PROPERTY:DEFAULT DATABASE CHANGED

LOGIN CHANGE PROPERTY:DEFAULT LANGUAGE

LOGIN CHANGE PROPERTY:DEFAULT LANGUAGE CHANGED

LOGIN CHANGE PROPERTY:EXPIRATION CHANGED

LOGIN CHANGE PROPERTY:NAME CHANGED

LOGIN CHANGE PROPERTY:POLICY CHANGED

ALTER USER

ALTER USER

ALTER USER

ALTER USER

ALTER USER

ALTER USER

ALTER USER

ALTER USER

Audit Server Object Management Event

SERVER OBJECT MANAGEMENT:CREDENTIAL MAP DROPPED

SERVER OBJECT MANAGEMENT:CREDENTIAL MAPPED TO LOGIN

ALTER USER

ALTER USER

Audit Server Principal Management Event

SERVER PRINCIPAL MANAGEMENT:ALTER: USER

SERVER PRINCIPAL MANAGEMENT:CREATE: USER

SERVER PRINCIPAL MANAGEMENT:DISABLE: USER

SERVER PRINCIPAL MANAGEMENT:DROP: USER

SERVER PRINCIPAL MANAGEMENT:ENABLE: USER

ALTER USER

CREATE USER

DISABLE USER

DROP USER

ENABLE USER


Table B-2 lists the Microsoft SQL Server account management event attributes.

Table B-2 SQL Server Account Management Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.3 Application Management Events

Application management events track actions that were performed on the underlying SQL statements, such as creating objects. The Procedure Management Report, described in Section 3.3.3.5, uses these events.

Table B-3 lists the Microsoft SQL Server application management source database events and the equivalent Oracle Audit Vault events.

Table B-3 SQL Server Application Management Audit Events

Event Name Description Source Event Audit Vault Event

Audit Database Object Take Ownership Event

DATABASE OBJECT TAKE OWNERSHIP: TRIGGER

ALTER TRIGGER

Audit Schema Object Take Ownership Event

SCHEMA OBJECT TAKE OWNERSHIP: OBJECT

SCHEMA OBJECT TAKE OWNERSHIP: PROCEDURE

SCHEMA OBJECT TAKE OWNERSHIP: TYPE

SCHEMA OBJECT TAKE OWNERSHIP: TRIGGER

ALTER OBJECT

ALTER PROCEDURE

ALTER TYPE

ALTER TRIGGER

Audit Server Object Take Ownership Event

SERVER OBJECT TAKE OWNERSHIP: OBJECT

ALTER OBJECT

Object:Created

OBJECT:CREATED:PROCEDURE

OBJECT:CREATED:TRIGGER

OBJECT:CREATED:TYPE

CREATE PROCEDURE

CREATE TRIGGER

Object:Deleted

OBJECT:DELETED:PROCEDURE

OBJECT:DELETED:TRIGGER

DROP PROCEDURE

DROP TRIGGER


Table B-4 lists the Microsoft SQL Server application management event attributes.

Table B-4 SQL Server Application Management Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

ASSOCIATED_OBJECT_NAME

VARCHAR2(4000)

ASSOCIATED_OBJECT_OWNER

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

NEW_OBJECT_NAME

VARCHAR2(4000)

NEW_OBJECT_OWNER

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.4 Audit Command Events

Audit command events track the use of audit events, such as altering trace events. The Audit Command Report, described in Section 3.3.3.3, uses these events.

Table B-5 lists the Microsoft SQL Server audit command source database events and the equivalent Oracle Audit Vault events.

Table B-5 SQL Server Audit Command Audit Events

Event Name Description Source Event Audit Vault Event

Audit Change Audit Event

CHANGE AUDIT:AUDIT STARTED

CHANGE AUDIT:AUDIT STOPPED

CHANGE AUDIT:C2 MODE OFF

CHANGE AUDIT:C2 MODE ON

CHANGE:AUDIT STOPPED

CHANGE:NEW AUDIT STARTED

SYSTEM AUDIT

SYSTEM NOAUDIT

SYSTEM NOAUDIT

SYSTEM AUDIT

SYSTEM NOAUDIT

SYSTEM AUDIT

Audit Server Alter Trace Event

SERVER ALTER TRACE

ALTER TRACE

ExistingConnection

EXISTINGCONNECTION

EXISTING CONNECTION


Table B-6 lists the Microsoft SQL Server audit command events that are logged in the Windows Event Viewer.

Table B-6 SQL Server Audit Command Events Logged in Windows Event Viewer

Source Event Severity

OP ALTER TRACE: START

10

OP ALTER TRACE: STOP

10


Table B-7 lists the Microsoft SQL Server audit command event attributes.

Table B-7 SQL Server Audit Command Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

AUDIT_OPTION

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.5 Data Access Events

The data access event tracks SQL transactions. The Data Access Report, described in Section 3.3.2.3, uses these events.

Table B-8 shows the Microsoft SQL Server data access source event and the equivalent Oracle Audit Vault event.

Table B-8 SQL Server Data Access Audit Events

Event Name Description Source Event Audit Vault Event

SQL Transaction

TRANSACTION:BEGIN

SQL-TRANSACTION


Table B-9 lists the Microsoft SQL Server data access event attributes.

Table B-9 SQL Server Data Access Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.6 Exception Events

Exception events track audited error and exception activity, such as background job errors. The Exception Activity Report, described in Section 3.3.4.2, uses these events.

Table B-10 lists the Microsoft SQL Server exception source database events and the equivalent Oracle Audit Vault events.

Table B-10 SQL Server Exception Audit Events

Event Name Description Source Event Audit Vault Event

Background Job Error

BACKGROUND JOB ERROR:ERROR RETURN

BACKGROUND JOB ERROR:FAILURE

BACKGROUND JOB ERROR:QUEUE IS FULL

ERROR

ERROR

ERROR

Blocked Process Report

BLOCKED PROCESS REPORT

ERROR


Table B-11 lists the Microsoft SQL Server exception events that are logged in the Windows Event Viewer.

Table B-11 SQL Server Exception Events Logged in the Windows Event Viewer

Source Event Severity Audit Vault Event

OP ERROR: COMMIT

10

ERROR

OP ERROR: DB OFFLINE

10

ERROR

OP ERROR: MIRRORING ERROR

16

ERROR

OP ERROR: .NET FATAL ERROR

16

ERROR

OP ERROR: .NET USER CODE

16

ERROR

OP ERROR: PROCESS VIOLATION

16

ERROR

OP ERROR: RECOVER

21

ERROR

OP ERROR: RESTORE FAILED

21

ERROR

OP ERROR: ROLLBACK

10

ERROR

OP ERROR: SERVER SHUT DOWN

21

ERROR

OP ERROR: STACK OVER FLOW

16

ERROR


Table B-12 lists the Microsoft SQL Server exception event attributes.

Table B-12 SQL Server Exception Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.7 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.3.4.3, uses the invalid record event attributes. (These events do not have any event names; they only contain event attributes.)

Table B-13 lists the Microsoft SQL Server invalid record event attributes.

Table B-13 SQL Server Invalid Record Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

ERROR_ID

NUMBER

ERROR_MESSAGE

VARCHAR2(30)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

MODULE_NAME

VARCHAR2(100)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

ORIGINAL_CONTENT1

VARCHAR2(4000)

ORIGINAL_CONTENT2

VARCHAR2(4000)

ORIGINAL_CONTENT3

VARCHAR2(4000)

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SEVERITY

NUMBER

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.8 Object Management Events

Object management events track audited actions performed on database objects, such as altering an object. The Object Management Report, described in Section 3.3.3.4, uses these events.

Table B-14 lists the Microsoft SQL Server object management source database events and the equivalent Oracle Audit Vault events.

Table B-14 SQL Server Object Management Audit Events

Event Name Description Source Event Audit Vault Event

Audit Database Object Access Event

DATABASE OBJECT ACCESS

ACCESS OBJECT

Audit Database Object Management Event

DATABASE OBJECT MANAGEMENT:ACCESS

ACCESS OBJECT

Audit Database Object Take Ownership Event

DATABASE OBJECT TAKE OWNERSHIP: OBJECT

DATABASE OBJECT TAKE OWNERSHIP: SCHEMA

ALTER OBJECT

ALTER SCHEMA

Audit Database Principal Management Event

DATABASE PRINCIPAL MANAGEMENT:ALTER: OBJECT

DATABASE PRINCIPAL MANAGEMENT:CREATE: OBJECT

DATABASE PRINCIPAL MANAGEMENT:DROP: OBJECT

ALTER OBJECT

CREATE OBJECT

DROP OBJECT

Audit Schema Object Access Event

SCHEMA OBJECT ACCESS

ACCESS OBJECT

Audit Schema Object Management Event

SCHEMA OBJECT MANAGEMENT:ALTER

SCHEMA OBJECT MANAGEMENT:CREATE

SCHEMA OBJECT MANAGEMENT:DROP

SCHEMA OBJECT MANAGEMENT:TRANSFER

ALTER SCHEMA

ALTER SCHEMA

ALTER SCHEMA

ALTER SCHEMA

Audit Schema Object Take Ownership Event

SCHEMA OBJECT TAKE OWNERSHIP: INDEX

SCHEMA OBJECT TAKE OWNERSHIP: OBJECT

SCHEMA OBJECT TAKE OWNERSHIP: TABLE

ALTER INDEX

ALTER OBJECT

ALTER TABLE

Audit Server Object Take Ownership Event

SERVER OBJECT TAKE OWNERSHIP: OBJECT

ALTER OBJECT

Lock:Deadlock

LOCK:DEADLOCK

Deadlock Presence

Lock:Deadlock Chain

LOCK:DEADLOCK CHAIN

LOCK:DEADLOCK CHAIN:RESOURCE TYPE LOCK

Deadlock Presence

DEADLOCK

Object:Altered

OBJECT:ALTERED

OBJECT:ALTERED:COMMIT

OBJECT:ALTERED:INDEX

OBJECT:ALTERED:PROCEDURE

OBJECT:ALTERED:ROLLBACK

OBJECT:ALTERED:TABLE

OBJECT:ALTERED:TRIGGER

OBJECT:ALTERED:TYPE

ALTER OBJECT

COMMIT

ALTER INDEX

ALTER PROCEDURE

ROLLBACK

ALTER TABLE

ALTER TRIGGER

ALTER TYPE

Object:Closed

OBJECT:CLOSED

None

Object:Created

OBJECT:CREATED

OBJECT:CREATED:COMMIT

OBJECT:CREATED:INDEX

OBJECT:CREATED:PROCEDURE

OBJECT:CREATED:ROLLBACK

OBJECT:CREATED:SCHEMA

OBJECT:CREATED:SYNONYM

OBJECT:CREATED:TABLE

OBJECT:CREATED:TRIGGER

OBJECT:CREATED:TYPE

OBJECT:CREATED:VIEW

CREATE OBJECT

COMMIT

CREATE INDEX

CREATE PROCEDURE

ROLLBACK

CREATE SCHEMA

CREATE SYNONYM

CREATE TABLE

CREATE TRIGGER

CREATE TYPE

CREATE VIEW

Object:Deleted

OBJECT:DELETED

OBJECT:DELETED:COMMIT

OBJECT:DELETED:INDEX

OBJECT:DELETED:PROCEDURE

OBJECT:DELETED:ROLLBACK

OBJECT:DELETED:SYNONYM

OBJECT:DELETED:TABLE

OBJECT:DELETED:TRIGGER

OBJECT:DELETED:TYPE

OBJECT:DELETED:VIEW

DROP OBJECT

COMMIT

DROP INDEX

DROP PROCEDURE

ROLLBACK

DROP SYNONYM

DROP TABLE

DROP TRIGGER

DROP TYPE

DROP VIEW


Table B-15 lists the Microsoft SQL Server object management event attributes.

Table B-15 SQL Server Object Management Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

ASSOCIATED_OBJECT_NAME

VARCHAR2(4000)

ASSOCIATED_OBJECT_OWNER

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

NEW_OBJECT_NAME

VARCHAR2(4000)

NEW_OBJECT_OWNER

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.9 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.2.5, uses these events. (These events do not have any event names; they only contain event attributes.)

Table B-16 lists the Microsoft SQL Server peer association event attributes.

Table B-16 SQL Server Peer Association Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.10 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting a user access permission. The Role and Privilege Management Report, described in Section 3.3.3.6, uses these events.

Table B-17 lists the Microsoft SQL Server role and privilege management source database events and the equivalent Oracle Audit Vault events.

Table B-17 SQL Server Role and Privilege Management Audit Events

Event Name Description Source Event Audit Vault Event

Audit Add DB User Event

ADD DB USER:GRANT DATABASE ACCESS

ADD DB USER:GRANTDBACCESS

ADD DB USER:REVOKE DATABASE ACCESS

ADD DB USER:REVOKEDBACCESS

GRANT ROLE

GRANT ROLE

REVOKE ROLE

REVOKE ROLE

Audit Add Login to Server Role Event

ADD LOGIN TO SERVER ROLE:ADD

ADD LOGIN TO SERVER ROLE:DROP

GRANT ROLE

REVOKE ROLE

Audit Add Member to DB Role Event

ADD MEMBER TO DB ROLE:ADD

ADD MEMBER TO DB ROLE:CHANGE GROUP

ADD MEMBER TO DB ROLE:DROP

GRANT ROLE

ALTER ROLE

REVOKE ROLE

Audit Add Role Event

ADD ROLE:ADD

ADD ROLE:DROP

GRANT ROLE

REVOKE ROLE

Audit App Role Change Password Event

APP ROLE CHANGE PASSWORD

ALTER APP ROLE

Audit Database Object GDR Event

DATABASE OBJECT GDR:DENY

DATABASE OBJECT GDR:GRANT

DATABASE OBJECT GDR:REVOKE

DENY OBJECT

GRANT OBJECT

REVOKE OBJECT

Audit Database Principal Management Event

DATABASE PRINCIPAL MANAGEMENT:ALTER: ROLE

DATABASE PRINCIPAL MANAGEMENT:CREATE: ROLE

DATABASE PRINCIPAL MANAGEMENT:DROP: ROLE

ALTER ROLE

CREATE ROLE

DROP ROLE

Audit Login GDR Event

LOGIN GDR:DENY

LOGIN GDR:GRANT

LOGIN GDR:REVOKE

DENY ROLE

GRANT ROLE

REVOKE ROLE

Audit Object Derived Permission Event

OBJECT DERIVED PERMISSION:ALTER OBJECT

OBJECT DERIVED PERMISSION:CREATE OBJECT

OBJECT DERIVED PERMISSION:DROP OBJECT

OBJECT DERIVED PERMISSION:DUMP OBJECT

OBJECT DERIVED PERMISSION:LOAD OBJECT

CHECK PRIVILEGE

CHECK PRIVILEGE

CHECK PRIVILEGE

CHECK PRIVILEGE

CHECK PRIVILEGE

Audit Object GDR Event

OBJECT GDR:DENY

OBJECT GDR:GRANT

OBJECT GDR:REVOKE

DENY OBJECT

GRANT OBJECT

REVOKE OBJECT

Audit Object Permission Event

OBJECT PERMISSION

CHECK PRIVILEGE

Audit Server Object GDR Event

SERVER OBJECT GDR:DENY

SERVER OBJECT GDR:GRANT

SERVER OBJECT GDR:REVOKE

DENY OBJECT

GRANT OBJECT

REVOKE OBJECT

Audit Server Scope GDR Event

SERVER SCOPE GDR:DENY

SERVER SCOPE GDR:GRANT

SERVER SCOPE GDR:REVOKE

DENY ROLE

GRANT ROLE

REVOKE ROLE

Audit Statement GDR Event

STATEMENT GDR:DENY

STATEMENT GDR:GRANT

STATEMENT GDR:REVOKE

DENY ROLE

GRANT ROLE

REVOKE ROLE

Audit Statement Permission Event

STATEMENT PERMISSION

CHECK PRIVILEGE


Table B-18 lists the Microsoft SQL Server role and privilege management event attributes.

Table B-18 SQL Server Role and Privilege Management Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

ADMIN_OPTION

NUMBER

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GRANTEE

VARCHAR2(4000)

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

ROLE_NAME

VARCHAR2(4000)

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

SYSTEM_PRIVILEGE

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.11 Service and Application Utilization Events

Service and application utilization events track audited application access activity. The Procedure Executions Report, described in Section 3.3.2.6, uses these events.

Table B-19 lists the Microsoft SQL Server service and application utilization source database events and the equivalent Oracle Audit Vault events.

Table B-19 SQL Server Service and Application Utilization Audit Events

Event Name Description Source Event Audit Vault Event

Audit Broker Conversation

BROKER CONVERSATION:INVALID SIGNATURE

BROKER CONVERSATION:NO CERTIFICATE

BROKER CONVERSATION:NO SECURITY HEADER

BROKER CONVERSATION:RUN AS TARGET FAILURE

SERVICE BROKER QUEING

SERVICE BROKER QUEING

SERVICE BROKER QUEING

SERVICE BROKER QUEING

Broker:Activation

BROKER:ACTIVATION:ABORTED

SERVICE BROKER QUEING

Broker:Queue Disabled

BROKER:QUEUE DISABLED

SERVICE BROKER QUEING


Table B-20 lists the Microsoft SQL Server service and application utilization event attributes.

Table B-20 SQL Server Service and Application Utilization Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.12 System Management Events

System management events track audited system management activity, such as backup and restore operations. The System Management Report, described in Section 3.3.3.7, uses these events.

Table B-21 lists the Microsoft SQL Server system management source database events and the equivalent Oracle Audit Vault events.

Table B-21 SQL Server System Management Audit Events

Event Name Description Source Event Audit Vault Event

Audit Add DB User Event

ADD DB USER:ADD

ADD DB USER:DROP

ADD DB USER:SP_ADDUSER

ADD DB USER:SP_DROPUSER

ALTER DATABASE

ALTER DATABASE

ALTER DATABASE

ALTER DATABASE

Audit Backup/Restore Event

BACKUP/RESTORE:BACKUP

BACKUP/RESTORE:BACKUPLOG

BACKUP/RESTORE:RESTORE

BACKUP

BACKUP

RESTORE

Audit Change Database Owner

CHANGE DATABASE OWNER

ALTER DATABASE

Audit Database Management Event

DATABASE MANAGEMENT:ALTER

DATABASE MANAGEMENT:CREATE

DATABASE MANAGEMENT:DROP

DATABASE MANAGEMENT:DUMP

DATABASE MANAGEMENT:LOAD

ALTER DATABASE

CREATE DATABASE

DROP DATABASE

BACKUP

RESTORE

Audit Database Object Management Event

DATABASE OBJECT MANAGEMENT:ALTER

DATABASE OBJECT MANAGEMENT:CREATE

DATABASE OBJECT MANAGEMENT:DROP

DATABASE OBJECT MANAGEMENT:DUMP

DATABASE OBJECT MANAGEMENT:LOAD

DATABASE OBJECT MANAGEMENT:OPEN

ALTER DATABASE

ALTER DATABASE

ALTER DATABASE

BACKUP

RESTORE

ALTER DATABASE

Audit Database Operation Event

DATABASE OPERATION:SUBSCRIBE TO QUERY NOTIFICATION

QN SUBSCRIPTION

Audit Database Principal Management Event

DATABASE PRINCIPAL MANAGEMENT:DUMP

DATABASE PRINCIPAL MANAGEMENT:LOAD

BACKUP

RESTORE

Audit DBCC Event

DB CONSISTENCY CHECK

CONSISTENCY CHECK

Audit Schema Object Management Event

SCHEMA OBJECT MANAGEMENT:DUMP

SCHEMA OBJECT MANAGEMENT:LOAD

BACKUP

RESTORE

Audit Server Object Management Event

SERVER OBJECT MANAGEMENT:ALTER

SERVER OBJECT MANAGEMENT:CREATE

SERVER OBJECT MANAGEMENT:DROP

SERVER OBJECT MANAGEMENT:DUMP

SERVER OBJECT MANAGEMENT:LOAD

ALTER SYSTEM

ALTER SYSTEM

ALTER SYSTEM

BACKUP

RESTORE

Audit Server Operation Event

SERVER OPERATION:ADMINISTER BULK OPERATIONS

SERVER OPERATION:ALTER RESOURCES

SERVER OPERATION:ALTER SERVER STATE

SERVER OPERATION:ALTER SETTINGS

SERVER OPERATION:AUTHENTICATE

SERVER OPERATION:EXTERNAL ACCESS

ALTER SYSTEM

ALTER SYSTEM

ALTER SYSTEM

ALTER SYSTEM

ALTER SYSTEM

ALTER SYSTEM

Audit Server Principal Management Event

SERVER PRINCIPAL MANAGEMENT:DUMP: USER

SERVER PRINCIPAL MANAGEMENT:LOAD: USER

BACKUP

RESTORE

Audit Server Starts and Stops

SERVER STARTS AND STOPS:SHUTDOWN

SERVER STARTS AND STOPS:STARTED

SERVER STARTS AND STOPS:PAUSED

SERVER STARTS AND STOPS:CONTINUE

SHUTDOWN

STARTUP

SUSPEND

RESUME

Audit Server Starts and Stops Event

SERVER STARTS AND STOPS:INSTANCE CONTINUED

SERVER STARTS AND STOPS:INSTANCE PAUSE

SERVER STARTS AND STOPS:INSTANCE SHUTDOWN

SERVER STARTS AND STOPS:INSTANCE STARTED

RESUME

SUSPEND

SHUTDOWN

STARTUP

Database Mirroring State Change

DATABASE MIRRORING STATE CHANGE

MIRRORING STATE CHANGED

Mount Tape

MOUNT TAPE:TAPE MOUNT CANCELLED

MOUNT TAPE:TAPE MOUNT COMPLETE

MOUNT TAPE:TAPE MOUNT REQUEST

MOUNT TAPE

MOUNT TAPE

MOUNT TAPE


Table B-22 lists the Microsoft SQL Server system management event attributes.

Table B-22 SQL Server System Management Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.13 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as user-created configurations. The Uncategorized Activity Report, described in Section 3.3.4.4, uses these events.

Table B-23 shows the Microsoft SQL Server unknown or uncategorized source database event and the equivalent Oracle Audit Vault event.

Table B-23 SQL Server Unknown or Uncategorized Event Attributes

Event Name Description Source Event Audit Vault Event

User Configurable (0-9)

USER CONFIGURABLE

USER CONFIGURABLE

SQL Statement Completed Event

SQL:StmtCompleted

SQL EXECUTION


Table B-24 lists the Microsoft SQL Server unknown or uncategorized event attributes.

Table B-24 SQL Server Unknown or Uncategorized Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)


B.14 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.2.7, uses these events.

Table B-25 lists the Microsoft SQL Server user session source database events and the equivalent Oracle Audit Vault events.

Table B-25 SQL Server User Session Audit Events

Event Name Description Source Event Audit Vault Event

Audit Broker Login

BROKER LOGIN:AUTHENTICATION FAILURE

BROKER LOGIN:LOGIN SUCCESS

BROKER LOGIN:LOGIN PROTOCOL ERROR

BROKER LOGIN:MESSAGE FORMAT ERROR

BROKER LOGIN:NEGOTIATE FAILURE

LOGON

LOGON

LOGON

LOGON

LOGON

Audit Database Mirroring Login Event

DATABASE MIRRORING LOGIN:LOGIN SUCCESS

DATABASE MIRRORING LOGIN:LOGIN PROTOCOL ERROR

DATABASE MIRRORING LOGIN:MESSAGE FORMAT ERROR

DATABASE MIRRORING LOGIN:NEGOTIATE FAILURE

DATABASE MIRRORING LOGIN:AUTHENTICATION FAILURE

DATABASE MIRRORING LOGIN:AUTHORIZATION FAILURE

LOGON

Audit Database Operation Event

DATABASE OPERATION:CHECKPOINT

SAVEPOINT

Audit Database Principal Impersonation Event

DATABASE PRINCIPAL IMPERSONATION

IMPERSONATION

Audit Login

AUDIT LOGIN:LOGIN

LOGON

Audit Login Event

AUDIT LOGIN EVENT:LOGIN

LOGON

Audit Login Failed

AUDIT LOGIN FAILED:LOGIN FAILED

LOGON

Audit Login Failed Event

AUDIT LOGIN FAILED EVENT:LOGIN FAILED

LOGON

Audit Logout

AUDIT LOGOUT:LOGOUT

LOGOFF

Audit Logout Event

AUDIT LOGOUT EVENT:LOGOUT

LOGOUT

Audit Server Principal Impersonation Event

SERVER PRINCIPAL IMPERSONATION

IMPERSONATION

SQL Transaction

SQL TRANSACTION:COMMIT

SQL TRANSACTION:ROLLBACK

SQL TRANSACTION:SAVEPOINT

COMMIT

ROLLBACK

SAVEPOINT


Table B-26 lists the Microsoft SQL Server user session event attributes.

Table B-26 SQL Server User Session Event Attributes

Attribute Name Data Type

ADDL_INFO

VARCHAR2(4000)

AUTHENTICATION_METHOD

VARCHAR2(255)

COLUMN_PERMISSIONS

NUMBER

CONTEXTID

VARCHAR2(4000)

CPU

NUMBER

DATABASE_ID

NUMBER

DATABASE_NAME

VARCHAR2(4000)

DBUSER_NAME

VARCHAR2(4000)

DURATION

NUMBER

END_TIME

TIMESTAMP

ENDUSER

VARCHAR2(4000)

EVENT_SEQUENCE

NUMBER

EVENT_STATUS

VARCHAR2(30)

EVENT_SUB_CLASS

NUMBER

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

GUID

NUMBER

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INDEX_ID

NUMBER

IS_SYSTEM

NUMBER

LINKED_SERVER_NAME

VARCHAR2(4000)

LOGIN_SID

VARCHAR2(4000)

OBJECT_ID

NUMBER

OBJECT_ID2

NUMBER

OSUSER_NAME

VARCHAR2(4000)

OWNER_ID

NUMBER

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

SERVER_NAME

VARCHAR2(4000)

SESSION_LOGIN_NAME

VARCHAR2(4000)

SOURCE_DATABASE_ID

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_LOGIN_NAME

VARCHAR2(4000)

TARGET_LOGIN_SID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OBJECT_TYPE

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

TEXT_DATA

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

USERNAME

VARCHAR2(4000)