F Microsoft SQL Server SQL Audit and Event Log Events

Topics

SQL Audit Events
Event Log Events

SQL Audit Events

SQL Audit Events map server-level, database-level groups of events and individual events. The Audit action items can be individual actions such as SELECT operations on a Table, or a group of actions such as SERVER_PERMISSION_CHANGE_GROUP.

SQL Audit Events track the following three categories of Events:

Server Level: These actions include server operations, such as management changes, and logon and logoff operations.
Database Level: These actions include data manipulation languages (DML) and Data Definition Language (DDL).
Audit Level: These actions include actions in the auditing process.

Table F-1 SQL Audit Events

Source Event	Event Description	command_class	target_type
`DATABASE_ROLE_MEMBER_CHANGE_GROUP`	Database Role Member Change Group	`ALTER`	Any from List 1
`BACKUP LOG`	Backup Log	`BACKUP`	Any from List 1
`ALTER RESOURCES`	Alter Resources	`ALTER`	Any from List 1
`DELETE`	Delete	`DELETE`	Any from List 1
`BROKER LOGIN`	Broker Login	`LOGIN`	Any from List 1
`LOGOUT GROUP`	Logout Group	`LOGOUT`	Any from List 1
`MUST CHANGE PASSWORD`	Must Change Password	`UPDATE`	Any from List 1
`DROP MEMBER`	Drop Member	`DROP`	Any from List 1
`DENY`	Deny	`DENY`	Any from List 1
`SEND`	Send	`SEND`	Any from List 1
`SELECT`	Select	`SELECT`	Any from List 1
`SERVER_CONTINUE`	Server Continue	`RESUME`	Any from List 1
`SERVER OPERATION GROUP`	Server Operation Group	`EXECUTE`	Any from List 1
`INSERT`	Insert	`INSERT`	Any from List 1
`EXECUTE`	Execute	`EXECUTE`	Any from List 1
`SHOW PLAN`	Show Plan	`EXECUTE`	Any from List 1
`SUCCESSFUL_LOGIN_GROUP`	Successful Login Group	`LOGIN`	Any from List 1
`SERVER_ROLE_MEMBER_CHANGE_GROUP`	Server Role Member Change Group	`ALTER`	Any from List 1
`ALTER TRACE`	Alter Trace	`ALTER`	Any from List 1
`CREDENTIAL MAP TO LOGIN`	Credential Map to Login	`SET`	Any from List 1
`FULL TEXT`	Full Text	`EXECUTE`	Any from List 1
`TRACE AUDIT C2ON`	Trace Audit C2On	`AUDIT`	Any from List 1
`BULK ADMIN`	Bulk Admin	`INSERT`	Any from List 1
`TRACE AUDIT C2OFF`	Trace Audit C2Off	`NOAUDIT`	Any from List 1
`VIEW SERVER STATE`	View Server State	`EXECUTE`	Any from List 1
`SCHEMA_OBJECT_ACCESS_GROUP`	Schema Object Access Group	`ACCESS`	Any from List 1
`ALTER CONNECTION`	Alter Connection	`ALTER`	Any from List 1
`ALTER SETTINGS`	Alter Settings	`ALTER`	Any from List 1
`ALTER SERVER STATE`	Alter Server State	`ALTER`	Any from List 1
`EXTERNAL ACCESS ASSEMBLY`	External Access Assembly	`ACCESS`	Any from List 1
`OPEN`	Open	`OPEN`	Any from List 1
`AUDIT SHUTDOWN ON FAILURE`	Audit Shutdown On Failure	`NOAUDIT`	Any from List 1
`AUDIT SESSION CHANGED`	Audit Session Changed	`AUDIT`	Any from List 1
`BACKUP_RESTORE_GROUP`	Backup Restore Group	`RESTORE`	Any from List 1
`SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP`	Server Object Ownership Change Group	`ALTER`	Any from List 1
`AUTHENTICATE`	Authenticate	`AUTHENTICATE`	Any from List 1
`DATABASE_OWNERSHIP_CHANGE_GROUP`	Database Ownership Change Group	`ALTER`	Any from List 1
`REFERENCES`	References	`ACCESS`	Any from List 1
`SERVER_STARTED`	Server Started	`STARTUP`	Any from List 1
`DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP`	Database Object Ownership Change Group	`ALTER`	Any from List 1
`SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP`	Schema Object Permission Change Group	`ALTER`	Any from List 1
`IMPERSONATE`	Impersonate	`PROXY`	Any from List 1
`CREATE`	Create	`CREATE`	Any from List 1
`SERVER_STATE_CHANGE_GROUP`	Server State Change Group	`ALTER`	Any from List 1
`TAKE OWNERSHIP`	Take Ownership	`ALTER`	Any from List 1
`TRANSFER`	Transfer	`MOVE`	Any from List 1
`CHANGE USERS LOGIN AUTO`	Change Users Login Auto	`ALTER`	Any from List 1
`ADD MEMBER`	Add Member	`UPDATE`	Any from List 1
`VIEW CHANGETRACKING`	View ChangeTracking	`EXECUTE`	Any from List 1
`LOGIN FAILED`	Login Failed	`LOGIN`	Any from List 1
`DATABASE_PRINCIPAL_CHANGE_GROUP`	Database Principal Change Group	`ALTER`	Any from List 1
`DATABASE_OBJECT_CHANGE_GROUP`	Database Object Change Group	`UPDATE`	Any from List 1
`DATABASE_MIRRORING_LOGIN_GROUP`	Database Mirroring Login Group	`LOGIN`	Any from List 1
`ALTER`	Alter	`LOGIN`	Any from List 1
`PASSWORD EXPIRATION`	Password Expiration	`EXPIRE`	Any from List 1
`UPDATE`	Update	`UPDATE`	Any from List 1
`NAME CHANGE`	Name Change	`ALTER`	Any from List 1
`LOGOUT`	Logout	`LOGOUT`	Any from List 1
`LOGIN SUCCEEDED`	Login Succeeded	`LOGIN`	Any from List 1
`DATABASE_CHANGE_GROUP`	Database Change Group	`UPDATE`	Any from List 1
`LOGIN_CHANGE_PASSWORD_GROUP`	Login Change Password Group	`UPDATE`	Any from List 1
`RESET OWN PASSWORD`	Reset Own Password	`RESET`	Any from List 1
`CHANGE USERS LOGIN`	Change Users Login	`ALTER`	Any from List 1
`TRACE_CHANGE_GROUP`	Trace Change Group	`ALTER`	Any from List 1
`FAILED_LOGIN_GROUP`	Failed Login Group	`LOGIN`	Any from List 1
`TRACE AUDIT STOP`	Trace Audit Stop	`NOAUDIT`	Any from List 1
`REVOKE`	Revoke	`REVOKE`	Any from List 1
`CHANGE OWN PASSWORD`	Change Own Password	`UPDATE`	Any from List 1
`CHANGE LOGIN CREDENTIAL`	Change Login Credential	`ALTER`	Any from List 1
`RECEIVE`	Receive	`GET`	Any from List 1
`AUDIT_CHANGE_GROUP`	Audit Change Group	`AUDIT`	Any from List 1
`CHANGE DEFAULT LANGUAGE`	Change Default Language	`ALTER`	Any from List 1
`CHANGE PASSWORD`	Change Password	`UPDATE`	Any from List 1
`RESTORE`	Restore	`RESTORE`	Any from List 1
`DATABASE MIRRORING LOGIN`	Database Mirroring Login	`LOGIN`	Any from List 1
`REVOKE WITH CASCADE`	Revoke with Cascade	`REVOKE`	Any from List 1
`DROP`	Drop	`DROP`	Any from List 1
`SERVER_OBJECT_CHANGE_GROUP`	Server Object Change Group	`ALTER`	Any from List 1
`VIEW_DATABASE_STATE`	View Database State	`EXECUTE`	Any from List 1
`SERVER_PRINCIPAL_CHANGE_GROUP`	Server Principal Change Group	`ALTER`	Any from List 1
`UNLOCK ACCOUNT`	Unlock Account	`UNLOCK`	Any from List 1
`FULLTEXT_GROUP`	Fulltext Group	`EXECUTE`	Any from List 1
`ENABLE`	Enable	`ENABLE`	Any from List 1
`PASSWORD POLICY`	Password Policy	`UPDATE`	Any from List 1
`REVOKE WITH GRANT`	Revoke With Grant	`REVOKE`	Any from List 1
`DATABASE_PRINCIPAL_IMPERSONATION_GROUP`	Database Principal Impersonation Group	`PROXY`	Any from List 1
`RESET PASSWORD`	Reset Password	`RESET`	Any from List 1
`SUBSCRIBE QUERY NOTIFICATION`	Subscribe Query Notification	`SUBSCRIBE`	Any from List 1
`SERVER_PRINCIPAL_IMPERSONATION_GROUP`	Server Principal Impersonation Group	`PROXY`	Any from List 1
`APPLICATION_ROLE_CHANGE_PASSWORD_GROUP`	Application Role Change Password Group	`UPDATE`	Any from List 1
`TRACE AUDIT START`	Trace Audit Start	`AUDIT`	Any from List 1
`DATABASE OBJECT PERMISSION CHANGE GROUP`	Database Object Permission Change Group	`ALTER`	Any from List 1
`SERVER PAUSED`	Server Paused	`PAUSE`	Any from List 1
`DATABASE_OPERATION_GROUP`	Database Operation Group	`DML`	Any from List 1
`ACCESS`	Access	`ACCESS`	Any from List 1
`DATABASE_PERMISSION_CHANGE_GROUP`	Database Permission Change Group	`ALTER`	Any from List 1
`UNSAFE ASSEMBLY`	Unsafe Assembly	`ACCESS`	Any from List 1
`DENY WITH CASCADE`	Deny with Cascade	`DENY`	Any from List 1
`DBCC_GROUP`	DBCC Group	`EXECUTE`	Any from List 1
`BROKER_LOGIN_GROUP`	Broker Login Group	`LOGIN`	Any from List 1
`CHECKPOINT`	Checkpoint	`SAVEPOINT`	Any from List 1
`SERVER SHUTDOWN`	Server Shutdown	`SHUTDOWN`	Any from List 1
`NO CREDENTIAL MAP TO LOGIN`	No Credential Map to Login	`SET`	Any from List 1
`SCHEMA_OBJECT_CHANGE_GROUP`	Schema Object Change Group	`ALTER`	Any from List 1
`CONNECT`	Connect	`CONNECT`	Any from List 1
`GRANT WITH GRANT`	Grant with Grant	`GRANT`	Any from List 1
`CHANGE DEFAULT DATABASE`	Change Default Database	`ALTER`	Any from List 1
`DISABLE`	Disable	`DISABLE`	Any from List 1
`SCHEMA_OBJECT_OWNERSHIP CHANGE_GROUP`	Schema Object Ownership Change Group	`ALTER`	Any from List 1
`GRANT`	Grant	`GRANT`	Any from List 1
`SERVER_PERMISSION_CHANGE_GROUP`	Server Permission Change Group	`ALTER`	Any from List 1
`SERVER_OBJECT_PERMISSION CHANGE_GROUP`	Server Object Permission Change Group	`ALTER`	Any from List 1
`DATABASE_OBJECT_ACCESS_GROUP`	Database Object Access Group	`ACCESS`	Any from List 1
`DBCC`	DBCC	`EXECUTE`	Any from List 1
`BACKUP`	Backup	`BACKUP`	Any from List 1

Event Log Events

Event Log Events help you audit server-level, database-level and individual events. These events consist of zero or more audit action items which can be either a group of actions (DATABASE_MIRRORING_LOGIN_GROUP) or individual actions (SELECT or REVOKE).

The Event Log Events track the following three categories of events.

Server Level: These actions include server operations such as management changes, and logon and logoff operations.
Database Level: These actions include data manipulation (DML) languages and Data Definition Language (DDL).
Audit Level: These actions include actions in the auditing process.

Table F-2 Event Log Events

Source Events	Event Description	command_class	target_types
`OP ALTER TRACE:STOP`	OP Alter Trace: Stop	`STOP`	`DATABASE`
`OP ALTER TRACE:START`	OP Alter Trace: Start (Event ID: 19033)	`START`	`DATABASE`
`OP ALTER TRACE:START`	OP Alter Trace: Start (Event ID: 19034)	`START`	`DATABASE`
`LOGIN FAILED: ONLY ADMINISTRATORS CAN CONNECT AT THIS TIME`	Login Failed: Only Administrators Can Connect At This Time (Event ID: 18450)	`LOGIN`	`DATABASE`
`LOGIN FAILED: ONLY ADMINISTRATORS CAN CONNECT AT THIS TIME`	Login Failed: Only Administrators Can Connect At This Time (Event ID: 18451)	`LOGIN`	`DATABASE`
`LOGIN FAILED: UNTRUSTED DOMAIN`	Login Failed: Untrusted Domain	`LOGIN`	`DATABASE`
`LOGIN SUCCEEDED: TRUSTED`	Login Succeeded: Trusted	`LOGIN`	`DATABASE`
`LOGIN SUCCEEDED: NON-TRUSTED`	Login Succeeded: Non-Trusted	`LOGIN`	`DATABASE`
`LOGIN SUCCEEDED`	Login Succeeded	`LOGIN`	`DATABASE`
`LOGIN FAILED`	Login Failed	`LOGIN`	`DATABASE`
`LOGIN FAILED: ILLEGAL USER NAME`	Login Failed: Illegal User Name	`LOGIN`	`DATABASE`
`LOGIN FAILED: SIMULTANEOUS LICENSE LIMIT`	Login Failed: Simultaneous License Limit	`LOGIN`	`DATABASE`
`LOGIN FAILED: WORKSTATION LICENSING LIMIT`	Login Failed: Workstation Licensing Limit	`LOGIN`	`DATABASE`
`LOGIN FAILED: SIMULTANEOUS LICENSE LIMIT`	Login Failed: Simultaneous License Limit	`LOGIN`	`DATABASE`
`LOGIN FAILED: SERVER IN SINGLE USER MODE`	Login Failed: Server in Single User Mode	`LOGIN`	`DATABASE`
`LOGIN FAILED: ACCOUNT DISABLED`	Login Failed: Account Disabled	`LOGIN`	`DATABASE`
`LOGIN FAILED: ACCOUNT LOCKED`	Login Failed: Account Locked	`LOGIN`	`DATABASE`
`LOGIN FAILED: PASSWORD EXPIRED`	Login Failed: Password Expired	`LOGIN`	`DATABASE`
`LOGIN FAILED: PASSWORD MUST BE CHANGED`	Login Failed: Password Must Be Changed	`LOGIN`	`DATABASE`
`OP ERROR: SERVER SHUT DOWN`	OP Error: Server Shut Down	`RAISE`	`DATABASE`
`OP ERROR: MIRRORING ERROR`	OP Error: Mirroring Error	`RAISE`	`DATABASE`
`OP ERROR: STACK OVER FLOW`	OP Error: Stack Over Flow	`RAISE`	`DATABASE`
`OP ERROR: COMMIT`	OP Error: Commit	`RAISE`	`DATABASE`
`OP ERROR: ROLLBACK`	OP Error: Rollback	`RAISE`	`DATABASE`
`OP ERROR: DB OFFLINE`	OP Error: DB Offline	`RAISE`	`DATABASE`
`OP ERROR: PROCESS VIOLATION`	OP Error: Process Violation	`RAISE`	`DATABASE`
`OP ERROR: RESTORE FAILED`	OP Error: Restore Failed	`RAISE`	`DATABASE`
`OP ERROR: RECOVER`	OP Error: Recover	`RAISE`	`DATABASE`
`OP ERROR: .NET FATAL ERROR`	OP Error: .NET Fatal Error	`RAISE`	`DATABASE`
`OP ERROR: .NET USER CODE`	OP Error: .NET User Code	`RAISE`	`DATABASE`
`NOTIFICATION SERVICE`	Notification Service	`RAISE`	`DATABASE`
`PASSWORD POLICY UPDATE SUCCESFUL`	Password Policy Update Successful	`UPDATE`	`POLICY`
`OP` modify: `START`	OP Modify: Start	`STARTUP`	`DATABASE`
`OP` modify: `STOP`	OP Modify: Stop	`SHUTDOWN`	`DATABASE`

Target Type Values

Target Type values associated with certain audit events can be any from the following list. See the Audit Event tables in this Appendix for references.

List 1

Possible Target Types	Class_Type
`CONSTRAINT`	`F`
`DATABASE`	`DT`
`DATABASE`	`DN`
`KEY`	`DK`
`CONSTRAINT`	`UQ`
`USER`	`US`
`CATALOG`	`FC`
`ENDPOINT`	`EP`
`NOTIFICATION`	`EN`
`VIEW`	`V`
`TYPE`	`TY`
`TREE`	`XR`
`FUNCTION`	`FS`
`FUNCTION`	`FT`
`FUNCTION`	`FN`
`STOPLIST`	`FL`
`USER`	`WU`
`GROUP`	`WG`
`USER`	`WL`
`STORED PROCEDURE`	`X`
`USER`	`GU`
`RESOURCE`	`RG`
`FILTER`	`RF`
`ROLE`	`RL`
`TABLE`	`S`
`ASSEMBLY`	`AS`
`ROLE`	`AR`
`QUERY`	`AQ`
`USER`	`AU`
`CONSTRAINT`	`C`
`QUERY`	`PQ`
`BROKER PRIORITY`	`PR`
`PARTITION`	`PS`
`AGGREGATE`	`AF`
`KEY`	`AK`
`USER`	AL
`RULE`	`R`
Undocumented	AP
`FUNCTION`	`TF`
`DEFAULT`	`D`
`TRIGGER`	`TR`
`USER`	`SU`
`SERVICE`	`SV`
`STATISTICS`	`ST`
`SCHEMA`	`SX`
`SERVICE`	`BN`
`TABLE`	`U`
`ASSEMBLY`	`TA`
`SERVER`	`SD`
`SCHEMA`	`SC`
`SESSION`	`SE`
`ROLE`	`SG`
`USER`	`CU`
`CONTRACT`	`CT`
`USER`	`SL`
`DATABASE`	`DB`
`KEY`	`SK`
`AUDIT SPECIFICATION`	`DA`
`SYNONYM`	`SN`
`SERVER`	`SR`
`QUEUE`	`SQ`
`ROUTE`	`RT`
`CREDENTIAL`	`CD`
`CERTIFICATE`	`CR`
`SERVER`	`CO`
`PROVIDER`	`CP`
`SERVER`	`T`
`AUDIT SPECIFICATION`	`SA`
`USER`	`CL`
`USER`	`LX`
`KEY`	`MK`
`MESSAGE`	`MT`
`OBJECT`	`ON`
`OBJECT`	`OB`
`STORED PROCEDURE`	`P`
`PRIMARY KEY`	`PK`
`FUNCTION`	`PF`
`ASSEMBLY`	`PC`
`SERVER AUDIT`	`A`
`FUNCTION`	`IF`
`FUNCTION`	`IS`
`TABLE`	`IT`
`INDEX`	`IX`