Hi,
I enabled c2 auditing on a sql server and loaded those files in to a table for analysing last one month database activity.
Requirement: I want to list out all the users who accessed any database in that server.
Can you please let me know what data should i analyse and also can you provide me the query for analysing data.
SELECT TOP 1000 [TextData]
,[BinaryData]
,[DatabaseID]
,[TransactionID]
,[LineNumber]
,[NTUserName]
,[NTDomainName]
,[HostName]
,[ClientProcessID]
,[ApplicationName]
,[LoginName]
,[SPID]
,[Duration]
,[StartTime]
,[EndTime]
,[Reads]
,[Writes]
,[CPU]
,[Permissions]
,[Severity]
,[EventSubClass]
,[ObjectID]
,[Success]
,[IndexID]
,[IntegerData]
,[ServerName]
,[EventClass]
,[ObjectType]
,[NestLevel]
,[State]
,[Error]
,[Mode]
,[Handle]
,[ObjectName]
,[DatabaseName]
,[FileName]
,[OwnerName]
,[RoleName]
,[TargetUserName]
,[DBUserName]
,[LoginSid]
,[TargetLoginName]
,[TargetLoginSid]
,[ColumnPermissions]
,[LinkedServerName]
,[ProviderName]
,[MethodName]
,[RowCounts]
,[RequestID]
,[XactSequence]
,[EventSequence]
,[BigintData1]
,[BigintData2]
,[GUID]
,[IntegerData2]
,[ObjectID2]
,[Type]
,[OwnerID]
,[ParentName]
,[IsSystem]
,[Offset]
,[SourceDatabaseID]
,[SqlHandle]
,[SessionLoginName]
,[PlanHandle]
,[GroupID]
FROM [audit].[dbo].[audit]