Audit log viewer
Hi to all
I'm newbie to SQL Server.
I'm trying to configure the server (Enterprise ver. 11) to track change regarding insert/update/delete of records inside a simple single table.
I dont know exactly what and how the audit features of SQL Server write and track, but I need a table where I can read the changes on some table or some field of that tables.
I made some empirical temptatives.
I created the Audit Server (on Security of database instance). Then I created the "Server Audit Specification"...where I specified UPDATE as type, OBJECT...my table, and entity... my user that connect to database (For this temptative I'm using
a Access database linked/connected by ODBC. Work good because I see the changes made in Access, inside the SQL Management Studio).
than I activated the Audit Server... then activated Audit Specification (on my database schema).
I made some change on table... but I see empty the View Log Viewer.
I try to configure the audit server as file or as application. I don't know if the problem is there.
Could someone give me some basic/dummie suggestion?
thank you.
Daniele.b75
Hi,
Alternately, you can create a trigger to audit the table and then write certain information to another table. Here is a sample code.
create table demo
( c1 varchar(50)),
c2 varchar(50)),
go
create table audit_demo
old_c1 varchar(50)),
old_c2 varchar(50)),
audit_UserID varchar(50)),
audit_Timestamp datetime,
audit_action varchar(50))
go
create TRIGGER updDemo
ON demo
for UPDATE
as
if(UPDATE(c2))
begin
INSERT INTO audit_demo
(old_c1,
old_c2,
audit_UserID,
audit_Timestamp,
audit_action)
SELECT c1,c2,SUSER_SNAME(),GETDATE(),'update'
FROM deleted
end
insert into demo values('a','p')
insert into demo values('b','p')
insert into demo values('c','p')
insert into demo values('d','p')
demo for update trigger
select * from demo
select * from audit_demo
update demo set c2='ppp' where c1='b'
go
select * from demo
select * from audit_demo
Thanks.
Tracy Cai
TechNet Community Support
Similar Messages
-
Any SAP tool that will perform audit logging views of personal data?
Hi,
I am wondering if there is a SAP tool or a third party tool that will perform audit logging of end users when viewing personal data?
The audit record should contain: who is viewing, what data is being viewed and the date/time stamp.
This is required to meet data privacy legal requirements.
Janet S.There is a T-code SM20, through some requirement can be fulfilled.
Regards,
Subhash -
How to enable the Exchange 2010 Admin Audit logs in Event Viewer
How to enable the Exchange 2010 Admin Audit(Mailbox Auditing) logs in Event Viewer.
- Sivashankar. Please mark as answer/useful if my contribution is helpfulHi Siva,
We could execute the command below to view Administrator Audit Logging settings:
Get-AdminAuditLogConfig
If it is not enabled, please run the command below:
Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
In addition, here are some references for you to utilize this feature:
Configure Administrator Audit Logging :
http://technet.microsoft.com/en-us/library/dd335109(v=exchg.141).aspx
Search the Administrator Audit Log :
http://technet.microsoft.com/en-us/library/ff459262(v=exchg.141).aspx
Regards,
Rebecca Tu
TechNet Community Support -
'Content viewing' in 'Audit Log reports' throws timout error
I have enabled 'Reports' in the site collection features and I am tryin gto generate the 'Content viewing' in 'Audit Log reports'. This keeps me waiting for a couple of minutes and throws a timeout error. Could you please let me know why is this happening
and is there any way to resolve it ?
I am getting the below error in UI and in my logging database
System.Exception
Reason: Request timed out. URL:
https://Mydomain/Mysitecollection/_layouts/RunReport.aspx/Content_viewing.xml
Thank you
Regards Rahul AHi,
According to your issue, firstly, please check if your hardware performance is poor or the site collection has numerous data, if so, improve the hardware or pull the
data out of the tables, then check the effect.
Secondly, if you cannot view audit reports for the site http://servername /sites/sitename
Try to detach and attach content database for the site you want to view, then check the effect.
Thanks,
Rock Wang
Regards, Rock Wang Microsoft Online Community Support -
I am new at the SQL auditing feature. I have played around with it, and I have one problem that I hope someone can help me with. When I first turn on the SQL audit and the audit file is small I can view the log on my local machine with the log viewer in
SSMS. However, as the log files continue to be created and grow, the log file viewer no longer works. It sits there for several minutes saying "initializing log file #1", then just comes back 0 records processed. Sometimes it comes back with an OutOfMemoryException.
I have the SQL audit set to go to files, and the files are set to be 250 MB each.
Is there some better way to look at the SQL audit log files generated, or is there some way to make the log file viewer actually work once the log files begin to grow? I know I can use Transact-SQL statements, but I was hoping to use the log file viewer
or some other GUI viewer. Another issue I'm concerned about is being able to archive the log files to another location and having the ability to look at them.
Thank you.Its looks like bug.
http://connect.microsoft.com/SQLServer/feedback/details/709364/sql-server-audit-logs-do-not-display
http://thomaslarock.com/2012/10/viewing-sql-server-2008-r2-audit-logs-using-ssms-2012/
Use sys.fn_get_audit_file() system function to see the data that you already doing.
http://msdn.microsoft.com/en-us/library/cc280765.aspx
-Prashanth -
I got warning in audit log but I don't get any alerts...
Hello,
I have File Adapter sender with FCC.
Because I was curious how FCC will behave when invalid file is used as a source file.
I deleted much of the contents in the source file and the File adpater with FCC read it.
In communication channel monitoring in RWB, I got this message in Audit log.
"Empty document found - proceed without sending message".
However, I cannot find this message anywhere else... Either in Message Monitoring (RWB) or SXMB_MONI (SAPGUI).
Also, I don't get any alerts.
How do I get alerts when file is not processed by file adapter?
Also, how do I view alert view for this kind of error?
Thank you.
-WonHi Won,
I suppose that you have checked alredy that your alerts are setup correctly and rules are defined for it.
First, you might set the log level of the file adapter to debug - you should see the issue in the NWA log.
Should PI try to generate an alert but fails, you would also see it here and locate your problem.
But, my opinon is that your chances are not very good to get an alert in such case. SAP decided for which issue they issue an alert and for which not.
When you have an empty file in the file adapter, it seems that SAP thiks that this is not to critical and therefore they don't issue an alert.
The reason why you dont see it anywhere else is, that the adapter generates a message id only when there is something to make a message. Empty file means no message and you can not see it in the monitoring tools.
best regards,
Markus -
Hi,
I'm using the workflow application "Audit" as an activity in my custom workflow and I'm passing the required arguments.
In the workflow trace file, I can see that the Audit application is run using the passed parameters but no record is being created matching that information in the "log" table.
Any ideas/suggestions?
Thanks
Here is the trace for your information:
Resolved reference requesterWSUser = object
Assigning requesterFullName = Test1 Manager1
Action Set Audit Resources List
Result title set to 'Set Audit Resources List'
Evaluating XPRESS
Resolved reference approved = false
Resolved reference auditApps = [AD_Simulated]
Resolved reference auditApps = [AD_Simulated]
Assigning depApps = [AD_Simulated]
Action Audit
Result title set to 'Audit'
Iterating over depApps = [AD_Simulated]
Iteration 0
app = AD_Simulated
Argument op = audit
Argument type = User
Argument status = success
Argument action = View
Argument reason = User Access Recertification
Argument subject = TestManager1
Resolved reference user.waveset.organization = null
Resolved reference app = AD_Simulated
Resolved reference app = AD_Simulated
Argument resource = AD_Simulated
Resolved reference enduserId = testuser4
Argument accountId = testuser4
Resolved reference enduserView.accounts[Lighthouse].firstname = Test4
Resolved reference enduserView.accounts[Lighthouse].lastname = User4
Resolved reference enduserId = testuser4
Resolved reference requesterFullName = Test1 Manager1
Argument error = The access of the user Test4 User4(testuser4) has been recertified by Test1 Manager1
Calling application 'com.waveset.session.WorkflowServices'
Application requested argument op
Application requested argument logResultErrors
Application requested argument action
Application requested argument status
Application requested argument type
Application requested argument subject
Application requested argument name
Application requested argument resource
Application requested argument accountId
Application requested argument error
Application requested argument parameters
Application requested argument attributes
Application requested argument originalAttributes
Application requested argument overflowAttributes
Application requested argument auditableAttributesList
Application requested argument organizations
Step complete 'Audit'
Step inactive 'Display Message'
-------------------------------------------------------------------------I agree with the anokun7. Check to make sure the action your are giving it is a valid one. ( See IDM Workflow Forms and Views pdf and search for Action Names, it will give you a list of all the valid actions) Also you can add your own attributes to the Audit object as well using the attributes variable. ( It expects a map: <map>
<s>Key</s>
<ref>value</ref>
<map>
Value can be a reference, or string, or however complex you want to make it. Just be aware of what view (if any) is available at the time you call the audit. Hope this helps
Message was edited by:
dmac28
Oh yeah..The attributes will appear on the audit log reports, Based on what action and type you audited it will show up on that record. i.e Delete action, on Type User...that audit record will have a changes value which will have whatever attributes you passed to the audit object. -
Hi all,
We just recently installed SP1 for AQ6.0 and it has helped out alot. Fixed alot of our small issues, but seems to have brougt up a new one. Our Audit Log Management job is now failing every run. It is getting an Access denied error. Actually the error line is JobShell: Exception occurred when processing operation operation 0:103: \\ntapmd01\Plumtree5\PtAudit\audit 9-8-06 2.log (Access is denied). Running verbose dosen't help. I see that the job is running as owner Administrator and I am trying to copy the audit log to a shared network location, but this worked before. Nothing changed except for installing the SP. Any ideas?
BerneyFirst off, it seems like installing the patch reset the user account that ran the plumtree automation service. All I had to do was change the user who runs the automation service and that fixed it.
As far as service patch 1 goes we had alot of issues when we went to 6.0 with remote users opening documents. SSO redirect kept sending them back to the home page. We had issues with the Intrinsic Community Links portlet, protected excel files, along with some others I can't think of right now. Everything looked fine from the admin point of view, but users were going crazy. All of that went away with the service patch.
Thanks,
Berney -
Audit Log is required for Project server
Hi,
Audit Log is required for EPM / Project Server 2010
Following are the requirements.
Project Name, Resource Name and Date of Following Events.
1. Project checked Out By, Date (This is highly important)
2. Project Checked In By, Date
3. Project Published By, Date
4. Project Saved By, DateHi Hachishti,
Please refer to a recent similar thread with excellent answer from Paul.
http://social.technet.microsoft.com/Forums/projectserver/en-US/435fbb7a-1c82-419c-b83e-e89419dc66aa/project-server-2010-view-plan-save-history?forum=projectserver2010general
Hope this helps.
Guillaume Rouyre - MBA, MCP, MCTS -
Audit log in communication channel monitoring(MDT)
Hi,
I am doing a soap lookup in my message mapping for an interface.In order to monitor the request and response communication , I am unable to see the 'Audit Log' for the soap communication channel that was configured for the same.On clicking the message id for viewing the audit log,an error page is displayed as "Requested Page not found"
Could you please help me as to why I am unable to see the Audit Log.
Regards
JaniceHi! Janice,
Could you guide me as to where I can set the parameter for sync logging in AE
You can got to
1) T Code: SXMB_ADM
2) Click Integration Engine Configuration
3) Again click Configuration
4) Now Keep the parameter as TRACE_LEVEL = 3 instead of 0 or 1 or 2.
then again go to SXMB_MONI there you can view now SOAP Request and Response.
I hope now it is resolved right
Regards
Amar Srinivas Eli -
Is it possible to customize audit summary view - CRM 2011
Hi,
Is it possible to modify or customize the default "Audit summary view" of Auditing in crm 2011?
Apart from enabling or disabling filters, i don't see any options to modify the view so that i can add more columns or remove few columns from the default view?
Please do share your valuable inputs.
Thanks.Hi,
Existing audit logs can be viewed by navigating to Settings -> Auditing -> Audit Summary View. The
resulting view is fixed by the system with predetermined columns that display the date and time of the event, the type of event, who made the change, the record effected by the event, the corresponding entity type and the operation performed.
This data cannot be exported to Excel like the standard grids. To assist in finding relevant data, filters can be enabled for all the columns except the effected record column; this works similarly to the corresponding functionality in Excel. Selecting an
individual audit record will provide additional details for the given transaction.
So we can't change this system view. -
Automatic User Device Affinity - Audit logs retention
Hello,
We have problems on generating primary user info on a lot Computers and we suspect that problem is because audit logs are kept for too short time.
So the config is following:
1) User device affinity threshold (minutes): 2880
2) User device affinity threshold (days): 30
So there are two questions:
1) For how long do we need to keep audit logs on SCCM client to successfully generate user device affinity;
2) How long do we need to wait till information populates in SCCM DB?
Thanks,
PēterisAlso from UserAffinity.log I can see that information is sent with state messages:
"Found same state message existing. (was sent before) Skip sending same state message for user"
Hi,
You could try to delete state message about the user in WMI on a client to see if user device affinity could be populated. That is stored in root\ccm\statemsg -> Enum Classes -> Recursive -> double-click CCM_StateMsg -> Instances. There
should be messages that contain "domain/user_Auto".
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
hi friends,
I have activated audit log and i can able to view log with SM20. But I have one doubt .......is that audit log occupies space in file system only (or) Database level only? or it occupies both? is it possible to get this audit log from any table? never mind please clarity my doubt.
thanks
naniHi,
Please check below link.
http://help.sap.com/saphelp_nw04s/helpdata/EN/03/37dc4c25e4344db2935f0d502af295/content.htm
Anil -
Support situation of Audit Log feature
Hello,
We now make a study for migration our on premise SP2013 to online(Japan Region).
Although content be shown in URL below, a part of audit log doesn't support at this moment,
we need to get their logs.
Could we make a alternate solution to get their 3 logs below ?
"For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available."
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2Hello,
We now make a study for migration our on premise SP2013 to online(Japan Region).
Although content be shown in URL below, a part of audit log doesn't support at this moment,
we need to get their logs.
Could we make a alternate solution to get their 3 logs below ?
"For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available."
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2 -
Departname in audit log report
Hi,
I am getting user data of viewing the pages within the site from audit log reports.
But our customer is expecting to see the department name of the user that he belongs to.
I dont see this value in the report.
So please let me know to get the department name of the user.
Regards,
Sudheer
Thanks & Regards, SudheerHi,
Use custom code
http://sharepoint.stackexchange.com/questions/62929/get-current-users-department-name-and-manager-from-active-directory
http://sharepoint.stackexchange.com/questions/89703/getting-user-job-title-from-a-sharepoint-list-through-active-directory
Use designer workflows
http://www.sharepointanalysthq.com/2011/04/user-profile-data-in-sharepoint-designer-workflows/
Please remember to click 'Mark as Answer' on the answer if it helps you
Maybe you are looking for
-
MacBook Pro 13 inch and 16 GB of RAM.
On apple support page i can see that mac book pro 13.3 supports only 8 GB of RAM! http://support.apple.com/kb/ht1651?viewlocale=ja_jp&locale=ja_jp#link1 But i really need to install 16 GB of RAM! Is it supported by MacBook pro 13 inch hardware? I wan
-
Why won't iMovie open my project?
This is extremely aggravating, iMovie suddenly wont open 2 of my projects. I was working on them for hours and finally got them how i wanted them to be, and when i go to open it later, it won't open! All that happens when I click on it is that it let
-
Can I build OCI programs with the 8i I downloaded? If not, it's not worth the trouble installing it... Pleaze answer! Martin null
-
HT4972 update 5.1.1 failure
first i live in Jordan and i have purchased an iphone 4 a while back. however, a new update is available 5.1.1 and every time i try to download, it takes 5 hours and at the last 3 MB itunes gives me an "error timeout massage"!! what can i do? i tried
-
Navigating between applets from the same signed jar (trusted CA) gives err
See [http://www.chrisnewland.com/java-7-update-21-signedunsigned-error-switching-between-applets-in-the-same-signed-jar-trusted-ca-339] for my investigations so far. Clicking a link to navigate between applets contained in the same signed jar (signed