MSSQL Server audit

sakuraime 2,316 Reputation points
2021-04-27T09:20:55.893+00:00

I have a audit action like in the following
91618-image.png

is it possible to filter by login/ database username ??

SQL Server
SQL Server
A family of Microsoft relational database management and analysis systems for e-commerce, line-of-business, and data warehousing solutions.
12,682 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thomas LaRock 76 Reputation points
    2021-04-27T14:36:04.903+00:00

    Should be possible with the SUCCESSFUL_LOGIN_GROUP. Here is the complete list of audit groups and actions. https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15

    0 comments
  2. Cris Zhan-MSFT 6,601 Reputation points
    2021-04-28T02:53:56.473+00:00

    Hi @sakuraime ,

    It appears that you are creating a database audit specification.

    You can filter logins or database users in the SQL Server audit instead of audit specification level . Right-click the audit name(ie Audit-20120408-152028) in SSMS, select "Properties", enter the predicate or WHERE clause on the "Filter" page, for example: ([server_principal_name] <> N'sa'), ([database_principal_name]<>N'dbo')). Or you can also use T-SQL to Create or alter SQL Server Audit.

    SQL Server Audit Records
    https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-records?view=sql-server-ver15

    0 comments