Audit log viewer

Hi to all
I'm newbie to SQL Server.
I'm trying to configure the server (Enterprise ver. 11) to track change regarding  insert/update/delete of records inside a simple single table.
I dont know exactly what and how the audit features of SQL Server write and track, but I need a table where I can read the changes on some table or some field of that tables.
I made some empirical temptatives.
I created the Audit Server (on Security of database instance). Then I created the "Server Audit Specification"...where I specified UPDATE as type, OBJECT...my table, and entity... my user that connect to database (For this temptative I'm using
a Access database linked/connected by ODBC. Work good because I see the changes made in Access, inside the SQL Management Studio).
than I activated the Audit Server... then activated Audit Specification (on my database schema).
I made some change on table... but I see empty the View Log Viewer.
I try to configure the audit server as file or as application. I don't know if the problem is there.
Could someone give me some basic/dummie suggestion?
thank you.
Daniele.b75

Hi,
Alternately, you can create a trigger to audit the table and then write certain information to another table. Here is a sample code.
create table demo
( c1 varchar(50)),
c2 varchar(50)),
go
create table audit_demo
old_c1 varchar(50)),
old_c2 varchar(50)),
audit_UserID varchar(50)),
audit_Timestamp datetime,
audit_action varchar(50))
go
create TRIGGER updDemo
ON demo
for UPDATE
as
if(UPDATE(c2))
begin
INSERT INTO audit_demo
(old_c1,
old_c2,
audit_UserID,
audit_Timestamp,
audit_action)
SELECT c1,c2,SUSER_SNAME(),GETDATE(),'update'
FROM deleted
end
insert into demo values('a','p')
insert into demo values('b','p')
insert into demo values('c','p')
insert into demo values('d','p')
demo for update trigger
select * from demo
select * from audit_demo
update demo set c2='ppp' where c1='b'
go
select * from demo
select * from audit_demo
Thanks.
Tracy Cai
TechNet Community Support

Similar Messages

  • Any SAP tool that will perform audit logging views of personal data?

    Hi, 
    I am wondering if there is a SAP tool or a third party tool  that will perform audit logging of end users when viewing personal data?
    The audit record should contain: who is viewing, what data is being viewed and the date/time stamp.
    This is required to meet data privacy legal requirements.
    Janet S.

    There is a T-code SM20, through some requirement can be fulfilled.
    Regards,
    Subhash

  • How to enable the Exchange 2010 Admin Audit logs in Event Viewer

    How to enable the Exchange 2010 Admin Audit(Mailbox Auditing) logs in Event Viewer.
    - Sivashankar. Please mark as answer/useful if my contribution is helpful

    Hi Siva,
    We could execute the command below to view Administrator Audit Logging settings:
    Get-AdminAuditLogConfig
    If it is not enabled, please run the command below:
    Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
    In addition, here are some references for you to utilize this feature:
    Configure Administrator Audit Logging :
    http://technet.microsoft.com/en-us/library/dd335109(v=exchg.141).aspx
    Search the Administrator Audit Log :
    http://technet.microsoft.com/en-us/library/ff459262(v=exchg.141).aspx
    Regards,
    Rebecca Tu
    TechNet Community Support

  • 'Content viewing' in 'Audit Log reports' throws timout error

    I have enabled 'Reports' in the site collection features and I am tryin gto generate the 'Content viewing' in 'Audit Log reports'. This keeps me waiting for a couple of minutes and throws a timeout error. Could you please let me know why is this happening
    and is there any way to resolve it  ?
    I am getting the below error in UI and in my logging database
    System.Exception
    Reason: Request timed out. URL:
    https://Mydomain/Mysitecollection/_layouts/RunReport.aspx/Content_viewing.xml
    Thank you
    Regards Rahul A

    Hi,
    According to your issue, firstly, please check if your hardware performance is poor or the site collection has numerous data, if so, improve the hardware or pull the
    data out of the tables, then check the effect.
    Secondly, if you cannot view audit reports for the site http://servername /sites/sitename
    Try to detach and attach content database for the site you want to view, then check the effect.
    Thanks,
    Rock Wang
    Regards, Rock Wang Microsoft Online Community Support

  • Viewing SQL Audit Logs

    I am new at the SQL auditing feature. I have played around with it, and I have one problem that I hope someone can help me with. When I first turn on the SQL audit and the audit file is small I can view the log on my local machine with the log viewer in
    SSMS. However, as the log files continue to be created and grow, the log file viewer no longer works. It sits there for several minutes saying "initializing log file #1", then just comes back 0 records processed. Sometimes it comes back with an OutOfMemoryException.
    I have the SQL audit set to go to files, and the files are set to be 250 MB each.
    Is there some better way to look at the SQL audit log files generated, or is there some way to make the log file viewer actually work once the log files begin to grow? I know I can use Transact-SQL statements, but I was hoping to use the log file viewer
    or some other GUI viewer. Another issue I'm concerned about is being able to archive the log files to another location and having the ability to look at them.
    Thank you.

    Its looks like bug.
    http://connect.microsoft.com/SQLServer/feedback/details/709364/sql-server-audit-logs-do-not-display
    http://thomaslarock.com/2012/10/viewing-sql-server-2008-r2-audit-logs-using-ssms-2012/
    Use sys.fn_get_audit_file() system function to see the data that you already doing.
     http://msdn.microsoft.com/en-us/library/cc280765.aspx
    -Prashanth

  • I got warning in audit log but I don't get any alerts...

    Hello,
    I have File Adapter sender with FCC.
    Because I was curious how FCC will behave when invalid file is used as a source file.
    I deleted much of the contents in the source file and the File adpater with FCC read it.
    In communication channel monitoring in RWB, I got this message in Audit log.
    "Empty document found - proceed without sending message".
    However, I cannot find this message anywhere else... Either in Message Monitoring (RWB) or SXMB_MONI (SAPGUI).
    Also, I don't get any alerts.
    How do I get alerts when file is not processed by file adapter?
    Also, how do I view alert view for this kind of error?
    Thank you.
    -Won

    Hi Won,
    I suppose that you have checked alredy that your alerts are setup correctly and rules are defined for it.
    First, you might set the log level of the file adapter to debug - you should see the issue in the NWA log.
    Should PI try to generate an alert but fails, you would also see it here and locate your problem.
    But, my opinon is that  your chances are not very good to get an alert in such case. SAP decided for which issue they issue an alert and for which not.
    When you have an empty file in the file adapter, it seems that SAP thiks that this is not to critical and therefore they don't issue an alert.
    The reason why you dont see it anywhere else is, that the adapter generates a message id only when there is something to make a message. Empty file means no message and you can not see it in the monitoring tools.
    best regards,
    Markus

  • Audit Log Not Being Created

    Hi,
    I'm using the workflow application "Audit" as an activity in my custom workflow and I'm passing the required arguments.
    In the workflow trace file, I can see that the Audit application is run using the passed parameters but no record is being created matching that information in the "log" table.
    Any ideas/suggestions?
    Thanks
    Here is the trace for your information:
    Resolved reference requesterWSUser = object
    Assigning requesterFullName = Test1 Manager1
    Action Set Audit Resources List
    Result title set to 'Set Audit Resources List'
    Evaluating XPRESS
    Resolved reference approved = false
    Resolved reference auditApps = [AD_Simulated]
    Resolved reference auditApps = [AD_Simulated]
    Assigning depApps = [AD_Simulated]
    Action Audit
    Result title set to 'Audit'
    Iterating over depApps = [AD_Simulated]
    Iteration 0
    app = AD_Simulated
    Argument op = audit
    Argument type = User
    Argument status = success
    Argument action = View
    Argument reason = User Access Recertification
    Argument subject = TestManager1
    Resolved reference user.waveset.organization = null
    Resolved reference app = AD_Simulated
    Resolved reference app = AD_Simulated
    Argument resource = AD_Simulated
    Resolved reference enduserId = testuser4
    Argument accountId = testuser4
    Resolved reference enduserView.accounts[Lighthouse].firstname = Test4
    Resolved reference enduserView.accounts[Lighthouse].lastname = User4
    Resolved reference enduserId = testuser4
    Resolved reference requesterFullName = Test1 Manager1
    Argument error = The access of the user Test4 User4(testuser4) has been recertified by Test1 Manager1
    Calling application 'com.waveset.session.WorkflowServices'
    Application requested argument op
    Application requested argument logResultErrors
    Application requested argument action
    Application requested argument status
    Application requested argument type
    Application requested argument subject
    Application requested argument name
    Application requested argument resource
    Application requested argument accountId
    Application requested argument error
    Application requested argument parameters
    Application requested argument attributes
    Application requested argument originalAttributes
    Application requested argument overflowAttributes
    Application requested argument auditableAttributesList
    Application requested argument organizations
    Step complete 'Audit'
    Step inactive 'Display Message'
    -------------------------------------------------------------------------

    I agree with the anokun7. Check to make sure the action your are giving it is a valid one. ( See IDM Workflow Forms and Views pdf and search for Action Names, it will give you a list of all the valid actions) Also you can add your own attributes to the Audit object as well using the attributes variable. ( It expects a map: <map>
    <s>Key</s>
    <ref>value</ref>
    <map>
    Value can be a reference, or string, or however complex you want to make it. Just be aware of what view (if any) is available at the time you call the audit. Hope this helps
    Message was edited by:
    dmac28
    Oh yeah..The attributes will appear on the audit log reports, Based on what action and type you audited it will show up on that record. i.e Delete action, on Type User...that audit record will have a changes value which will have whatever attributes you passed to the audit object.

  • Audit Log Fails Access Denied

    Hi all,
    We just recently installed SP1 for AQ6.0 and it has helped out alot. Fixed alot of our small issues, but seems to have brougt up a new one. Our Audit Log Management job is now failing every run. It is getting an Access denied error. Actually the error line is JobShell: Exception occurred when processing operation operation 0:103: \\ntapmd01\Plumtree5\PtAudit\audit 9-8-06 2.log (Access is denied). Running verbose dosen't help. I see that the job is running as owner Administrator and I am trying to copy the audit log to a shared network location, but this worked before. Nothing changed except for installing the SP. Any ideas?
    Berney

    First off, it seems like installing the patch reset the user account that ran the plumtree automation service. All I had to do was change the user who runs the automation service and that fixed it.
    As far as service patch 1 goes we had alot of issues when we went to 6.0 with remote users opening documents. SSO redirect kept sending them back to the home page. We had issues with the Intrinsic Community Links portlet, protected excel files, along with some others I can't think of right now. Everything looked fine from the admin point of view, but users were going crazy. All of that went away with the service patch.
    Thanks,
    Berney

  • Audit Log is required for Project server

    Hi,
    Audit Log is required for EPM / Project Server 2010 
    Following are the requirements.
    Project Name, Resource Name and Date of Following Events.
    1. Project checked Out By, Date (This is highly important)
    2. Project Checked In By, Date
    3. Project Published By, Date
    4. Project Saved By, Date

    Hi Hachishti,
    Please refer to a recent similar thread with excellent answer from Paul.
    http://social.technet.microsoft.com/Forums/projectserver/en-US/435fbb7a-1c82-419c-b83e-e89419dc66aa/project-server-2010-view-plan-save-history?forum=projectserver2010general
    Hope this helps.
    Guillaume Rouyre - MBA, MCP, MCTS

  • Audit log in communication channel monitoring(MDT)

    Hi,
    I am doing a soap lookup in my message mapping for an interface.In order to monitor the request and response communication , I am unable to see the 'Audit Log' for the soap communication channel that was configured for the same.On clicking the message id for viewing the audit log,an error page is displayed as "Requested Page not found"
    Could you please help me as to why I am unable to see the Audit Log.
    Regards
    Janice

    Hi! Janice,
    Could you guide me as to where I can set the parameter for sync logging in AE
    You can got to
    1)  T Code: SXMB_ADM
    2)  Click Integration Engine Configuration        
    3)  Again  click Configuration
    4)  Now Keep the parameter as TRACE_LEVEL   = 3 instead of 0 or 1 or 2.
    then again go to SXMB_MONI there you can view now SOAP Request and Response.
    I hope now it is resolved right
    Regards
    Amar Srinivas Eli

  • Is it possible to customize audit summary view - CRM 2011

    Hi,
    Is it possible to modify or customize the default "Audit summary view" of Auditing in crm 2011?
    Apart from enabling or disabling filters, i don't see any options to modify the view so that i can add more columns or remove few columns from the default view?
    Please do share your valuable inputs.
    Thanks.

    Hi,
    Existing audit logs can be viewed by navigating to Settings -> Auditing -> Audit Summary View. The
    resulting view is fixed by the system with predetermined columns that display the date and time of the event, the type of event, who made the change, the record effected by the event, the corresponding entity type and the operation performed.
    This data cannot be exported to Excel like the standard grids. To assist in finding relevant data, filters can be enabled for all the columns except the effected record column; this works similarly to the corresponding functionality in Excel. Selecting an
    individual audit record will provide additional details for the given transaction.
    So we can't change this system view.

  • Automatic User Device Affinity - Audit logs retention

    Hello,
    We have problems on generating primary user info on a lot Computers and we suspect that problem is because audit logs are kept for too short time.
    So the config is following:
    1) User device affinity threshold (minutes): 2880
    2) User device affinity threshold (days): 30
    So there are two questions:
    1) For how long do we need to keep audit logs on SCCM client to successfully generate user device affinity;
    2) How long do we need to wait till information populates in SCCM DB?
    Thanks,
    Pēteris

    Also from UserAffinity.log I can see that information is sent with state messages:
    "Found same state message existing. (was sent before) Skip sending same state message for user"
    Hi,
    You could try to delete state message about the user in WMI on a client to see if user device affinity could be populated. That is stored in root\ccm\statemsg -> Enum Classes -> Recursive -> double-click CCM_StateMsg -> Instances. There
    should be messages that contain "domain/user_Auto".
    Best Regards,
    Joyce
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Sm19 audit log

    hi friends,
    I have activated audit log and i can able to view log with SM20. But I have one doubt .......is that audit log occupies space in file system only (or) Database level only? or it occupies both? is it possible to get this audit log from any table? never mind please clarity my doubt.
    thanks
    nani

    Hi,
    Please check below link.
    http://help.sap.com/saphelp_nw04s/helpdata/EN/03/37dc4c25e4344db2935f0d502af295/content.htm
    Anil

  • Support situation of Audit Log feature

    Hello,
    We now make a study for migration our on premise SP2013 to online(Japan Region).
    Although content be shown in URL below, a part of audit log doesn't support at this moment,
    we need to get their logs.
    Could we make a alternate solution to get their 3 logs below ?
    "For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available."
    https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2

    Hello,
    We now make a study for migration our on premise SP2013 to online(Japan Region).
    Although content be shown in URL below, a part of audit log doesn't support at this moment,
    we need to get their logs.
    Could we make a alternate solution to get their 3 logs below ?
    "For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available."
    https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2

  • Departname in audit log report

    Hi,
    I am getting user data of viewing the pages within the site from audit log reports.
    But our customer is expecting to see the department name of the user that he belongs to.
    I dont see this value in the report.
    So please let me know to get the department name of the user.
    Regards,
    Sudheer
    Thanks & Regards, Sudheer

    Hi,
    Use custom code
    http://sharepoint.stackexchange.com/questions/62929/get-current-users-department-name-and-manager-from-active-directory
    http://sharepoint.stackexchange.com/questions/89703/getting-user-job-title-from-a-sharepoint-list-through-active-directory
    Use designer workflows
    http://www.sharepointanalysthq.com/2011/04/user-profile-data-in-sharepoint-designer-workflows/
    Please remember to click 'Mark as Answer' on the answer if it helps you

Maybe you are looking for

  • MacBook Pro 13 inch and 16 GB of RAM.

    On apple support page i can see that mac book pro 13.3 supports only 8 GB of RAM! http://support.apple.com/kb/ht1651?viewlocale=ja_jp&locale=ja_jp#link1 But i really need to install 16 GB of RAM! Is it supported by MacBook pro 13 inch hardware? I wan

  • Why won't iMovie open my project?

    This is extremely aggravating, iMovie suddenly wont open 2 of my projects. I was working on them for hours and finally got them how i wanted them to be, and when i go to open it later, it won't open! All that happens when I click on it is that it let

  • OCI header files

    Can I build OCI programs with the 8i I downloaded? If not, it's not worth the trouble installing it... Pleaze answer! Martin null

  • HT4972 update 5.1.1 failure

    first i live in Jordan and i have purchased an iphone 4 a while back. however, a new update is available 5.1.1 and every time i try to download, it takes 5 hours and at the last 3 MB itunes gives me an "error timeout massage"!! what can i do? i tried

  • Navigating between applets from the same signed jar (trusted CA) gives err

    See [http://www.chrisnewland.com/java-7-update-21-signedunsigned-error-switching-between-applets-in-the-same-signed-jar-trusted-ca-339] for my investigations so far. Clicking a link to navigate between applets contained in the same signed jar (signed