• Article

Security Audit Event Category (SQL Server Profiler)

The Security Audit event category contains security audit events.

In This Section

Topic

Description

Audit Add DB User Event Class

Indicates that a login has been added or removed as a database user to a database.

Audit Add Login to Server Role Event Class

Indicates that a login was added or removed from a fixed server role.

Audit Add Member to DB Role Event Class

Indicates that a login has been added to or removed from a role.

Audit Add Role Event Class

Indicates that a database role was added to or removed from a database.

Audit Addlogin Event Class

Indicates that a login has been added or removed.

Audit App Role Change Password Event Class

Indicates that a password has been changed for an application role.

Audit Backup/Restore Event Class

Indicates that a backup or restore statement has been issued.

Audit Broker Conversation Event Class

Reports audit messages related to Service Broker dialog security.

Audit Broker Login Event Class

Reports audit messages related to Service Broker transport security.

Audit Change Audit Event Class

Indicates that an audit trace modification has been made.

Audit Change Database Owner Event Class

Indicates that the permissions to change the owner of a database have been checked.

Audit Database Management Event Class

Indicates that a database has been created, altered, or dropped.

Audit Database Mirroring Login Event Class

Reports audit messages related to database mirroring transport security.

Audit Database Object Access Event Class

Indicates that a database object, such as a schema, has been accessed.

Audit Database Object GDR Event Class

Indicates that a GDR event for a database object has occurred.

Audit Database Object Management Event Class

Indicates that a CREATE, ALTER, or DROP statement was executed on a database object.

Audit Database Object Take Ownership Event Class

Indicates that there has been a change of owner for objects in database scope.

Audit Database Operation Event Class

Indicates that various operations such as checkpoint or subscribe query notification have occurred.

Audit Database Principal Impersonation Event Class

Indicates that an impersonation has occurred within the database scope.

Audit Database Principal Management Event Class

Indicates that principals have been created, altered, or dropped from a database.

Audit Database Scope GDR Event Class

Indicates that a GRANT, REVOKE, or DENY has been issued for a statement permission by a user in Microsoft SQL Server.

Audit DBCC Event Class

Indicates that a DBCC command has been issued.

Audit Login Change Password Event Class

Indicates that a user has changed their SQL Server login password.

Audit Login Change Property Event Class

Indicates that sp_defaultdb, sp_defaultlanguage, or ALTER LOGIN was used to modify a property of a login.

Audit Login Event Class

Indicates that a user has successfully logged into SQL Server.

Audit Login Failed Event Class

Indicates that a user attempted to log in to SQL Server and failed.

Audit Login GDR Event Class

Indicates that a Microsoft Windows login right was added or removed.

Audit Logout Event Class

Indicates that a user has logged out of SQL Server.

Audit Object Derived Permission Event Class

Indicates that a CREATE, ALTER, or DROP was issued for an object.

Audit Schema Object Access Event Class

Indicates that an object permission (such as SELECT) has been used.

Audit Schema Object GDR Event Class

Indicates that a GRANT, REVOKE, or DENY was issued for a schema object permission by a user in SQL Server.

Audit Schema Object Management Event Class

Indicates that a server object has been created, altered, or dropped.

Audit Schema Object Take Ownership Event Class

Indicates that the permissions to change the owner of schema object have been checked.

Audit Server Alter Trace Event Class

Indicates that the ALTER TRACE permission has been checked.

Audit Server Object GDR Event Class

Indicates that a GDR event for a schema object has occurred.

Audit Server Object Management Event Class

Indicates that a CREATE, ALTER, or DROP event has occurred for a server object.

Audit Server Object Take Ownership Event Class

Indicates that a server object owner has changed.

Audit Server Operation Event Class

Indicates that Audit operations have occurred in the server.

Audit Server Principal Impersonation Event Class

Indicates that an impersonation has occurred within the server scope.

Audit Server Principal Management Event Class

Indicates that a CREATE, ALTER, or DROP has occurred for a server principal.

Audit Server Scope GDR Event Class

Indicates that a GDR event has occurred for server permissions.

Audit Server Starts and Stops Event Class

Indicates that the SQL Server service state has been modified.

Audit Statement Permission Event Class

Indicates that a statement permission has been used.

See Also

Other Resources

Monitoring Events