Quantcast
Channel: Forum SQL Server Database Engine
Viewing all articles
Browse latest Browse all 15889

Logon trigger - capturing t-sql statements

$
0
0

Hello

I am trying to create a logon trigger to alert whenever anyone logs in using the loginname 'sa'. The logon trigger works fine with the code below inserting rows whenever anyone logs in using the 'sa' login. But I am trying to find out if there is a way to capture the t-sql statements run using that login? I tried adding the value 'tsqlcommand' for 'event_instance' while creating the trigger, but that column shows values of NULL and is not capturing the sql statements run using 'sa' login. Can anyone let me know if there is a way to capture the sql statements run using the logon triggers? I know running a server side trace is a way to do it, but I am trying to figure out if sql can be captured using a logon trigger which is simpler than having a server side trace run all the time.

 

 

CREATE TRIGGER [Trigger_ServerLogon]
ON ALL SERVER FOR LOGON
AS
BEGIN
declare @sa varchar(20)
DECLARE @data XML
SET @data = EVENTDATA()
select @sa= original_login()
if(select name from syslogins
where name='SA')=@sa
INSERT INTO bestst.dbo.ServerLogonHistory
  SELECT @data.value('(/EVENT_INSTANCE/PostTime)[1]', 'datetime')
    , @data.value('(/EVENT_INSTANCE/SPID)[1]', 'nvarchar(4)')
    , @data.value('(/EVENT_INSTANCE/ServerName)[1]', 'nvarchar(512)')
    , @data.value('(/EVENT_INSTANCE/LoginName)[1]', 'nvarchar(512)')
    , @data.value('(/EVENT_INSTANCE/LoginType)[1]', 'nvarchar(512)')
    , @data.value('(/EVENT_INSTANCE/SID)[1]', 'nvarchar(512)')
    , @data.value('(/EVENT_INSTANCE/ClientHost)[1]', 'nvarchar(512)')
				, @data.value('(/EVENT_INSTANCE/TSQLCommand)[1]', 'nvarchar(2000)') 
		 END
GO

 

 



Viewing all articles
Browse latest Browse all 15889

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>