Hello
I am trying to create a logon trigger to alert whenever anyone logs in using the loginname 'sa'. The logon trigger works fine with the code below inserting rows whenever anyone logs in using the 'sa' login. But I am trying to find out if there is a way to capture the t-sql statements run using that login? I tried adding the value 'tsqlcommand' for 'event_instance' while creating the trigger, but that column shows values of NULL and is not capturing the sql statements run using 'sa' login. Can anyone let me know if there is a way to capture the sql statements run using the logon triggers? I know running a server side trace is a way to do it, but I am trying to figure out if sql can be captured using a logon trigger which is simpler than having a server side trace run all the time.
CREATE TRIGGER [Trigger_ServerLogon] ON ALL SERVER FOR LOGON AS BEGIN declare @sa varchar(20) DECLARE @data XML SET @data = EVENTDATA() select @sa= original_login() if(select name from syslogins where name='SA')=@sa INSERT INTO bestst.dbo.ServerLogonHistory SELECT @data.value('(/EVENT_INSTANCE/PostTime)[1]', 'datetime') , @data.value('(/EVENT_INSTANCE/SPID)[1]', 'nvarchar(4)') , @data.value('(/EVENT_INSTANCE/ServerName)[1]', 'nvarchar(512)') , @data.value('(/EVENT_INSTANCE/LoginName)[1]', 'nvarchar(512)') , @data.value('(/EVENT_INSTANCE/LoginType)[1]', 'nvarchar(512)') , @data.value('(/EVENT_INSTANCE/SID)[1]', 'nvarchar(512)') , @data.value('(/EVENT_INSTANCE/ClientHost)[1]', 'nvarchar(512)') , @data.value('(/EVENT_INSTANCE/TSQLCommand)[1]', 'nvarchar(2000)') END GO