B Microsoft SQL Server Audit Events

This appendix contains:

• About the Microsoft SQL Server Audit Events

• Account Management Events

• Application Management Events

• Audit Command Events

• Data Access Events

• Exception Events

• Invalid Record Events

• Object Management Events

• Peer Association Events

• Role and Privilege Management Events

• Service and Application Utilization Events

• System Management Events

• Unknown or Uncategorized Events

• User Session Events

B.1 About the Microsoft SQL Server Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Microsoft SQL Server. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

• For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See "Creating a Basic Alert" for more information.

• For custom reports using third-party tools. If you want to create custom reports using other Oracle Database reporting products or third-party tools, then refer to the tables in this appendix when you design the reports. See Chapter 4, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with other tools.

B.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as adding logins or changing login passwords. The Account Management Report, described in Section 3.3.3.2, uses these events.

Table B-1 lists the Microsoft SQL Server account management source database events and the equivalent Oracle Audit Vault events.

Table B-1 SQL Server Account Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit AddLogin Event	ADDLOGIN:ADD ADDLOGIN:DROP	CREATE USER DROP USER
Audit Database Principal Management Event	DATABASE PRINCIPAL MANAGEMENT:ALTER: USER DATABASE PRINCIPAL MANAGEMENT:CREATE: USER DATABASE PRINCIPAL MANAGEMENT:DROP: USER	ALTER USER CREATE USER DROP USER
Audit Login Change Password Event	LOGIN CHANGE PASSWORD:PASSWORD CHANGED LOGIN CHANGE PASSWORD:PASSWORD MUST CHANGE LOGIN CHANGE PASSWORD:PASSWORD RESET LOGIN CHANGE PASSWORD:PASSWORD SELF CHANGED LOGIN CHANGE PASSWORD:PASSWORD SELF RESET LOGIN CHANGE PASSWORD:PASSWORD UNLOCKED	ALTER USER ALTER USER ALTER USER ALTER USER ALTER USER ALTER USER
Audit Login Change Property Event	LOGIN CHANGE PROPERTY:CREDENTIAL CHANGED LOGIN CHANGE PROPERTY:DEFAULT DATABASE LOGIN CHANGE PROPERTY:DEFAULT DATABASE CHANGED LOGIN CHANGE PROPERTY:DEFAULT LANGUAGE LOGIN CHANGE PROPERTY:DEFAULT LANGUAGE CHANGED LOGIN CHANGE PROPERTY:EXPIRATION CHANGED LOGIN CHANGE PROPERTY:NAME CHANGED LOGIN CHANGE PROPERTY:POLICY CHANGED	ALTER USER ALTER USER ALTER USER ALTER USER ALTER USER ALTER USER ALTER USER ALTER USER
Audit Server Object Management Event	SERVER OBJECT MANAGEMENT:CREDENTIAL MAP DROPPED SERVER OBJECT MANAGEMENT:CREDENTIAL MAPPED TO LOGIN	ALTER USER ALTER USER
Audit Server Principal Management Event	SERVER PRINCIPAL MANAGEMENT:ALTER: USER SERVER PRINCIPAL MANAGEMENT:CREATE: USER SERVER PRINCIPAL MANAGEMENT:DISABLE: USER SERVER PRINCIPAL MANAGEMENT:DROP: USER SERVER PRINCIPAL MANAGEMENT:ENABLE: USER	ALTER USER CREATE USER DISABLE USER DROP USER ENABLE USER

Table B-2 lists the Microsoft SQL Server account management event attributes.

Table B-2 SQL Server Account Management Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.3 Application Management Events

Application management events track actions that were performed on the underlying SQL statements, such as creating objects. The Procedure Management Report, described in Section 3.3.3.5, uses these events.

Table B-3 lists the Microsoft SQL Server application management source database events and the equivalent Oracle Audit Vault events.

Table B-3 SQL Server Application Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Database Object Take Ownership Event	DATABASE OBJECT TAKE OWNERSHIP: TRIGGER	ALTER TRIGGER
Audit Schema Object Take Ownership Event	SCHEMA OBJECT TAKE OWNERSHIP: OBJECT SCHEMA OBJECT TAKE OWNERSHIP: PROCEDURE SCHEMA OBJECT TAKE OWNERSHIP: TYPE SCHEMA OBJECT TAKE OWNERSHIP: TRIGGER	ALTER OBJECT ALTER PROCEDURE ALTER TYPE ALTER TRIGGER
Audit Server Object Take Ownership Event	SERVER OBJECT TAKE OWNERSHIP: OBJECT	ALTER OBJECT
Object:Created	OBJECT:CREATED:PROCEDURE OBJECT:CREATED:TRIGGER OBJECT:CREATED:TYPE	CREATE PROCEDURE CREATE TRIGGER
Object:Deleted	OBJECT:DELETED:PROCEDURE OBJECT:DELETED:TRIGGER	DROP PROCEDURE DROP TRIGGER

Table B-4 lists the Microsoft SQL Server application management event attributes.

Table B-4 SQL Server Application Management Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
ASSOCIATED_OBJECT_NAME	VARCHAR2(4000)
ASSOCIATED_OBJECT_OWNER	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
NEW_OBJECT_NAME	VARCHAR2(4000)
NEW_OBJECT_OWNER	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.4 Audit Command Events

Audit command events track the use of audit events, such as altering trace events. The Audit Command Report, described in Section 3.3.3.3, uses these events.

Table B-5 lists the Microsoft SQL Server audit command source database events and the equivalent Oracle Audit Vault events.

Table B-5 SQL Server Audit Command Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Change Audit Event	CHANGE AUDIT:AUDIT STARTED CHANGE AUDIT:AUDIT STOPPED CHANGE AUDIT:C2 MODE OFF CHANGE AUDIT:C2 MODE ON CHANGE:AUDIT STOPPED CHANGE:NEW AUDIT STARTED	SYSTEM AUDIT SYSTEM NOAUDIT SYSTEM NOAUDIT SYSTEM AUDIT SYSTEM NOAUDIT SYSTEM AUDIT
Audit Server Alter Trace Event	SERVER ALTER TRACE	ALTER TRACE
ExistingConnection	EXISTINGCONNECTION	EXISTING CONNECTION

Table B-6 lists the Microsoft SQL Server audit command events that are logged in the Windows Event Viewer.

Table B-6 SQL Server Audit Command Events Logged in Windows Event Viewer

Source Event	Severity
OP ALTER TRACE: START	10
OP ALTER TRACE: STOP	10

Table B-7 lists the Microsoft SQL Server audit command event attributes.

Table B-7 SQL Server Audit Command Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
AUDIT_OPTION	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.5 Data Access Events

The data access event tracks SQL transactions. The Data Access Report, described in Section 3.3.2.3, uses these events.

Table B-8 shows the Microsoft SQL Server data access source event and the equivalent Oracle Audit Vault event.

Table B-8 SQL Server Data Access Audit Events

Event Name Description	Source Event	Audit Vault Event
SQL Transaction	TRANSACTION:BEGIN	SQL-TRANSACTION

Table B-9 lists the Microsoft SQL Server data access event attributes.

Table B-9 SQL Server Data Access Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.6 Exception Events

Exception events track audited error and exception activity, such as background job errors. The Exception Activity Report, described in Section 3.3.4.2, uses these events.

Table B-10 lists the Microsoft SQL Server exception source database events and the equivalent Oracle Audit Vault events.

Table B-10 SQL Server Exception Audit Events

Event Name Description	Source Event	Audit Vault Event
Background Job Error	BACKGROUND JOB ERROR:ERROR RETURN BACKGROUND JOB ERROR:FAILURE BACKGROUND JOB ERROR:QUEUE IS FULL	ERROR ERROR ERROR
Blocked Process Report	BLOCKED PROCESS REPORT	ERROR

Table B-11 lists the Microsoft SQL Server exception events that are logged in the Windows Event Viewer.

Table B-11 SQL Server Exception Events Logged in the Windows Event Viewer

Source Event	Severity	Audit Vault Event
OP ERROR: COMMIT	10	ERROR
OP ERROR: DB OFFLINE	10	ERROR
OP ERROR: MIRRORING ERROR	16	ERROR
OP ERROR: .NET FATAL ERROR	16	ERROR
OP ERROR: .NET USER CODE	16	ERROR
OP ERROR: PROCESS VIOLATION	16	ERROR
OP ERROR: RECOVER	21	ERROR
OP ERROR: RESTORE FAILED	21	ERROR
OP ERROR: ROLLBACK	10	ERROR
OP ERROR: SERVER SHUT DOWN	21	ERROR
OP ERROR: STACK OVER FLOW	16	ERROR

Table B-12 lists the Microsoft SQL Server exception event attributes.

Table B-12 SQL Server Exception Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.7 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.3.4.3, uses the invalid record event attributes. (These events do not have any event names; they only contain event attributes.)

Table B-13 lists the Microsoft SQL Server invalid record event attributes.

Table B-13 SQL Server Invalid Record Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
ERROR_ID	NUMBER
ERROR_MESSAGE	VARCHAR2(30)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
MODULE_NAME	VARCHAR2(100)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
ORIGINAL_CONTENT1	VARCHAR2(4000)
ORIGINAL_CONTENT2	VARCHAR2(4000)
ORIGINAL_CONTENT3	VARCHAR2(4000)
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SEVERITY	NUMBER
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.8 Object Management Events

Object management events track audited actions performed on database objects, such as altering an object. The Object Management Report, described in Section 3.3.3.4, uses these events.

Table B-14 lists the Microsoft SQL Server object management source database events and the equivalent Oracle Audit Vault events.

Table B-14 SQL Server Object Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Database Object Access Event	DATABASE OBJECT ACCESS	ACCESS OBJECT
Audit Database Object Management Event	DATABASE OBJECT MANAGEMENT:ACCESS	ACCESS OBJECT
Audit Database Object Take Ownership Event	DATABASE OBJECT TAKE OWNERSHIP: OBJECT DATABASE OBJECT TAKE OWNERSHIP: SCHEMA	ALTER OBJECT ALTER SCHEMA
Audit Database Principal Management Event	DATABASE PRINCIPAL MANAGEMENT:ALTER: OBJECT DATABASE PRINCIPAL MANAGEMENT:CREATE: OBJECT DATABASE PRINCIPAL MANAGEMENT:DROP: OBJECT	ALTER OBJECT CREATE OBJECT DROP OBJECT
Audit Schema Object Access Event	SCHEMA OBJECT ACCESS	ACCESS OBJECT
Audit Schema Object Management Event	SCHEMA OBJECT MANAGEMENT:ALTER SCHEMA OBJECT MANAGEMENT:CREATE SCHEMA OBJECT MANAGEMENT:DROP SCHEMA OBJECT MANAGEMENT:TRANSFER	ALTER SCHEMA ALTER SCHEMA ALTER SCHEMA ALTER SCHEMA
Audit Schema Object Take Ownership Event	SCHEMA OBJECT TAKE OWNERSHIP: INDEX SCHEMA OBJECT TAKE OWNERSHIP: OBJECT SCHEMA OBJECT TAKE OWNERSHIP: TABLE	ALTER INDEX ALTER OBJECT ALTER TABLE
Audit Server Object Take Ownership Event	SERVER OBJECT TAKE OWNERSHIP: OBJECT	ALTER OBJECT
Lock:Deadlock	LOCK:DEADLOCK	Deadlock Presence
Lock:Deadlock Chain	LOCK:DEADLOCK CHAIN LOCK:DEADLOCK CHAIN:RESOURCE TYPE LOCK	Deadlock Presence DEADLOCK
Object:Altered	OBJECT:ALTERED OBJECT:ALTERED:COMMIT OBJECT:ALTERED:INDEX OBJECT:ALTERED:PROCEDURE OBJECT:ALTERED:ROLLBACK OBJECT:ALTERED:TABLE OBJECT:ALTERED:TRIGGER OBJECT:ALTERED:TYPE	ALTER OBJECT COMMIT ALTER INDEX ALTER PROCEDURE ROLLBACK ALTER TABLE ALTER TRIGGER ALTER TYPE
Object:Closed	OBJECT:CLOSED	None
Object:Created	OBJECT:CREATED OBJECT:CREATED:COMMIT OBJECT:CREATED:INDEX OBJECT:CREATED:PROCEDURE OBJECT:CREATED:ROLLBACK OBJECT:CREATED:SCHEMA OBJECT:CREATED:SYNONYM OBJECT:CREATED:TABLE OBJECT:CREATED:TRIGGER OBJECT:CREATED:TYPE OBJECT:CREATED:VIEW	CREATE OBJECT COMMIT CREATE INDEX CREATE PROCEDURE ROLLBACK CREATE SCHEMA CREATE SYNONYM CREATE TABLE CREATE TRIGGER CREATE TYPE CREATE VIEW
Object:Deleted	OBJECT:DELETED OBJECT:DELETED:COMMIT OBJECT:DELETED:INDEX OBJECT:DELETED:PROCEDURE OBJECT:DELETED:ROLLBACK OBJECT:DELETED:SYNONYM OBJECT:DELETED:TABLE OBJECT:DELETED:TRIGGER OBJECT:DELETED:TYPE OBJECT:DELETED:VIEW	DROP OBJECT COMMIT DROP INDEX DROP PROCEDURE ROLLBACK DROP SYNONYM DROP TABLE DROP TRIGGER DROP TYPE DROP VIEW

Table B-15 lists the Microsoft SQL Server object management event attributes.

Table B-15 SQL Server Object Management Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
ASSOCIATED_OBJECT_NAME	VARCHAR2(4000)
ASSOCIATED_OBJECT_OWNER	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
NEW_OBJECT_NAME	VARCHAR2(4000)
NEW_OBJECT_OWNER	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.9 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.2.5, uses these events. (These events do not have any event names; they only contain event attributes.)

Table B-16 lists the Microsoft SQL Server peer association event attributes.

Table B-16 SQL Server Peer Association Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.10 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting a user access permission. The Role and Privilege Management Report, described in Section 3.3.3.6, uses these events.

Table B-17 lists the Microsoft SQL Server role and privilege management source database events and the equivalent Oracle Audit Vault events.

Table B-17 SQL Server Role and Privilege Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Add DB User Event	ADD DB USER:GRANT DATABASE ACCESS ADD DB USER:GRANTDBACCESS ADD DB USER:REVOKE DATABASE ACCESS ADD DB USER:REVOKEDBACCESS	GRANT ROLE GRANT ROLE REVOKE ROLE REVOKE ROLE
Audit Add Login to Server Role Event	ADD LOGIN TO SERVER ROLE:ADD ADD LOGIN TO SERVER ROLE:DROP	GRANT ROLE REVOKE ROLE
Audit Add Member to DB Role Event	ADD MEMBER TO DB ROLE:ADD ADD MEMBER TO DB ROLE:CHANGE GROUP ADD MEMBER TO DB ROLE:DROP	GRANT ROLE ALTER ROLE REVOKE ROLE
Audit Add Role Event	ADD ROLE:ADD ADD ROLE:DROP	GRANT ROLE REVOKE ROLE
Audit App Role Change Password Event	APP ROLE CHANGE PASSWORD	ALTER APP ROLE
Audit Database Object GDR Event	DATABASE OBJECT GDR:DENY DATABASE OBJECT GDR:GRANT DATABASE OBJECT GDR:REVOKE	DENY OBJECT GRANT OBJECT REVOKE OBJECT
Audit Database Principal Management Event	DATABASE PRINCIPAL MANAGEMENT:ALTER: ROLE DATABASE PRINCIPAL MANAGEMENT:CREATE: ROLE DATABASE PRINCIPAL MANAGEMENT:DROP: ROLE	ALTER ROLE CREATE ROLE DROP ROLE
Audit Login GDR Event	LOGIN GDR:DENY LOGIN GDR:GRANT LOGIN GDR:REVOKE	DENY ROLE GRANT ROLE REVOKE ROLE
Audit Object Derived Permission Event	OBJECT DERIVED PERMISSION:ALTER OBJECT OBJECT DERIVED PERMISSION:CREATE OBJECT OBJECT DERIVED PERMISSION:DROP OBJECT OBJECT DERIVED PERMISSION:DUMP OBJECT OBJECT DERIVED PERMISSION:LOAD OBJECT	CHECK PRIVILEGE CHECK PRIVILEGE CHECK PRIVILEGE CHECK PRIVILEGE CHECK PRIVILEGE
Audit Object GDR Event	OBJECT GDR:DENY OBJECT GDR:GRANT OBJECT GDR:REVOKE	DENY OBJECT GRANT OBJECT REVOKE OBJECT
Audit Object Permission Event	OBJECT PERMISSION	CHECK PRIVILEGE
Audit Server Object GDR Event	SERVER OBJECT GDR:DENY SERVER OBJECT GDR:GRANT SERVER OBJECT GDR:REVOKE	DENY OBJECT GRANT OBJECT REVOKE OBJECT
Audit Server Scope GDR Event	SERVER SCOPE GDR:DENY SERVER SCOPE GDR:GRANT SERVER SCOPE GDR:REVOKE	DENY ROLE GRANT ROLE REVOKE ROLE
Audit Statement GDR Event	STATEMENT GDR:DENY STATEMENT GDR:GRANT STATEMENT GDR:REVOKE	DENY ROLE GRANT ROLE REVOKE ROLE
Audit Statement Permission Event	STATEMENT PERMISSION	CHECK PRIVILEGE

Table B-18 lists the Microsoft SQL Server role and privilege management event attributes.

Table B-18 SQL Server Role and Privilege Management Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
ADMIN_OPTION	NUMBER
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GRANTEE	VARCHAR2(4000)
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
ROLE_NAME	VARCHAR2(4000)
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
SYSTEM_PRIVILEGE	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.11 Service and Application Utilization Events

Service and application utilization events track audited application access activity. The Procedure Executions Report, described in Section 3.3.2.6, uses these events.

Table B-19 lists the Microsoft SQL Server service and application utilization source database events and the equivalent Oracle Audit Vault events.

Table B-19 SQL Server Service and Application Utilization Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Broker Conversation	BROKER CONVERSATION:INVALID SIGNATURE BROKER CONVERSATION:NO CERTIFICATE BROKER CONVERSATION:NO SECURITY HEADER BROKER CONVERSATION:RUN AS TARGET FAILURE	SERVICE BROKER QUEING SERVICE BROKER QUEING SERVICE BROKER QUEING SERVICE BROKER QUEING
Broker:Activation	BROKER:ACTIVATION:ABORTED	SERVICE BROKER QUEING
Broker:Queue Disabled	BROKER:QUEUE DISABLED	SERVICE BROKER QUEING

Table B-20 lists the Microsoft SQL Server service and application utilization event attributes.

Table B-20 SQL Server Service and Application Utilization Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.12 System Management Events

System management events track audited system management activity, such as backup and restore operations. The System Management Report, described in Section 3.3.3.7, uses these events.

Table B-21 lists the Microsoft SQL Server system management source database events and the equivalent Oracle Audit Vault events.

Table B-21 SQL Server System Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Add DB User Event	ADD DB USER:ADD ADD DB USER:DROP ADD DB USER:SP_ADDUSER ADD DB USER:SP_DROPUSER	ALTER DATABASE ALTER DATABASE ALTER DATABASE ALTER DATABASE
Audit Backup/Restore Event	BACKUP/RESTORE:BACKUP BACKUP/RESTORE:BACKUPLOG BACKUP/RESTORE:RESTORE	BACKUP BACKUP RESTORE
Audit Change Database Owner	CHANGE DATABASE OWNER	ALTER DATABASE
Audit Database Management Event	DATABASE MANAGEMENT:ALTER DATABASE MANAGEMENT:CREATE DATABASE MANAGEMENT:DROP DATABASE MANAGEMENT:DUMP DATABASE MANAGEMENT:LOAD	ALTER DATABASE CREATE DATABASE DROP DATABASE BACKUP RESTORE
Audit Database Object Management Event	DATABASE OBJECT MANAGEMENT:ALTER DATABASE OBJECT MANAGEMENT:CREATE DATABASE OBJECT MANAGEMENT:DROP DATABASE OBJECT MANAGEMENT:DUMP DATABASE OBJECT MANAGEMENT:LOAD DATABASE OBJECT MANAGEMENT:OPEN	ALTER DATABASE ALTER DATABASE ALTER DATABASE BACKUP RESTORE ALTER DATABASE
Audit Database Operation Event	DATABASE OPERATION:SUBSCRIBE TO QUERY NOTIFICATION	QN SUBSCRIPTION
Audit Database Principal Management Event	DATABASE PRINCIPAL MANAGEMENT:DUMP DATABASE PRINCIPAL MANAGEMENT:LOAD	BACKUP RESTORE
Audit DBCC Event	DB CONSISTENCY CHECK	CONSISTENCY CHECK
Audit Schema Object Management Event	SCHEMA OBJECT MANAGEMENT:DUMP SCHEMA OBJECT MANAGEMENT:LOAD	BACKUP RESTORE
Audit Server Object Management Event	SERVER OBJECT MANAGEMENT:ALTER SERVER OBJECT MANAGEMENT:CREATE SERVER OBJECT MANAGEMENT:DROP SERVER OBJECT MANAGEMENT:DUMP SERVER OBJECT MANAGEMENT:LOAD	ALTER SYSTEM ALTER SYSTEM ALTER SYSTEM BACKUP RESTORE
Audit Server Operation Event	SERVER OPERATION:ADMINISTER BULK OPERATIONS SERVER OPERATION:ALTER RESOURCES SERVER OPERATION:ALTER SERVER STATE SERVER OPERATION:ALTER SETTINGS SERVER OPERATION:AUTHENTICATE SERVER OPERATION:EXTERNAL ACCESS	ALTER SYSTEM ALTER SYSTEM ALTER SYSTEM ALTER SYSTEM ALTER SYSTEM ALTER SYSTEM
Audit Server Principal Management Event	SERVER PRINCIPAL MANAGEMENT:DUMP: USER SERVER PRINCIPAL MANAGEMENT:LOAD: USER	BACKUP RESTORE
Audit Server Starts and Stops	SERVER STARTS AND STOPS:SHUTDOWN SERVER STARTS AND STOPS:STARTED SERVER STARTS AND STOPS:PAUSED SERVER STARTS AND STOPS:CONTINUE	SHUTDOWN STARTUP SUSPEND RESUME
Audit Server Starts and Stops Event	SERVER STARTS AND STOPS:INSTANCE CONTINUED SERVER STARTS AND STOPS:INSTANCE PAUSE SERVER STARTS AND STOPS:INSTANCE SHUTDOWN SERVER STARTS AND STOPS:INSTANCE STARTED	RESUME SUSPEND SHUTDOWN STARTUP
Database Mirroring State Change	DATABASE MIRRORING STATE CHANGE	MIRRORING STATE CHANGED
Mount Tape	MOUNT TAPE:TAPE MOUNT CANCELLED MOUNT TAPE:TAPE MOUNT COMPLETE MOUNT TAPE:TAPE MOUNT REQUEST	MOUNT TAPE MOUNT TAPE MOUNT TAPE

Table B-22 lists the Microsoft SQL Server system management event attributes.

Table B-22 SQL Server System Management Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.13 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as user-created configurations. The Uncategorized Activity Report, described in Section 3.3.4.4, uses these events.

Table B-23 shows the Microsoft SQL Server unknown or uncategorized source database event and the equivalent Oracle Audit Vault event.

Table B-23 SQL Server Unknown or Uncategorized Event Attributes

Event Name Description	Source Event	Audit Vault Event
User Configurable (0-9)	USER CONFIGURABLE	USER CONFIGURABLE
SQL Statement Completed Event	SQL:StmtCompleted	SQL EXECUTION

Table B-24 lists the Microsoft SQL Server unknown or uncategorized event attributes.

Table B-24 SQL Server Unknown or Uncategorized Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

B.14 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.2.7, uses these events.

Table B-25 lists the Microsoft SQL Server user session source database events and the equivalent Oracle Audit Vault events.

Table B-25 SQL Server User Session Audit Events

Event Name Description	Source Event	Audit Vault Event
Audit Broker Login	BROKER LOGIN:AUTHENTICATION FAILURE BROKER LOGIN:LOGIN SUCCESS BROKER LOGIN:LOGIN PROTOCOL ERROR BROKER LOGIN:MESSAGE FORMAT ERROR BROKER LOGIN:NEGOTIATE FAILURE	LOGON LOGON LOGON LOGON LOGON
Audit Database Mirroring Login Event	DATABASE MIRRORING LOGIN:LOGIN SUCCESS DATABASE MIRRORING LOGIN:LOGIN PROTOCOL ERROR DATABASE MIRRORING LOGIN:MESSAGE FORMAT ERROR DATABASE MIRRORING LOGIN:NEGOTIATE FAILURE DATABASE MIRRORING LOGIN:AUTHENTICATION FAILURE DATABASE MIRRORING LOGIN:AUTHORIZATION FAILURE	LOGON
Audit Database Operation Event	DATABASE OPERATION:CHECKPOINT	SAVEPOINT
Audit Database Principal Impersonation Event	DATABASE PRINCIPAL IMPERSONATION	IMPERSONATION
Audit Login	AUDIT LOGIN:LOGIN	LOGON
Audit Login Event	AUDIT LOGIN EVENT:LOGIN	LOGON
Audit Login Failed	AUDIT LOGIN FAILED:LOGIN FAILED	LOGON
Audit Login Failed Event	AUDIT LOGIN FAILED EVENT:LOGIN FAILED	LOGON
Audit Logout	AUDIT LOGOUT:LOGOUT	LOGOFF
Audit Logout Event	AUDIT LOGOUT EVENT:LOGOUT	LOGOUT
Audit Server Principal Impersonation Event	SERVER PRINCIPAL IMPERSONATION	IMPERSONATION
SQL Transaction	SQL TRANSACTION:COMMIT SQL TRANSACTION:ROLLBACK SQL TRANSACTION:SAVEPOINT	COMMIT ROLLBACK SAVEPOINT

Table B-26 lists the Microsoft SQL Server user session event attributes.

Table B-26 SQL Server User Session Event Attributes

Attribute Name	Data Type
ADDL_INFO	VARCHAR2(4000)
AUTHENTICATION_METHOD	VARCHAR2(255)
COLUMN_PERMISSIONS	NUMBER
CONTEXTID	VARCHAR2(4000)
CPU	NUMBER
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
DBUSER_NAME	VARCHAR2(4000)
DURATION	NUMBER
END_TIME	TIMESTAMP
ENDUSER	VARCHAR2(4000)
EVENT_SEQUENCE	NUMBER
EVENT_STATUS	VARCHAR2(30)
EVENT_SUB_CLASS	NUMBER
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GUID	NUMBER
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INDEX_ID	NUMBER
IS_SYSTEM	NUMBER
LINKED_SERVER_NAME	VARCHAR2(4000)
LOGIN_SID	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_ID2	NUMBER
OSUSER_NAME	VARCHAR2(4000)
OWNER_ID	NUMBER
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
SERVER_NAME	VARCHAR2(4000)
SESSION_LOGIN_NAME	VARCHAR2(4000)
SOURCE_DATABASE_ID	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_LOGIN_NAME	VARCHAR2(4000)
TARGET_LOGIN_SID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OBJECT_TYPE	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
TEXT_DATA	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)