Security Audit Data Columns

The Security Audit event category has the following event classes:

• Audit Login class

• Audit Backup/Restore Event class

• Audit Logout class

• Audit Server Starts and Stops class

• Audit Object Permission Event class

The following tables list the data columns for each of these event classes.

Audit Login Event Class—Data Columns

Data Column	Description
ConnectionID	Contains the unique connection ID associated with the login event.
ServerName	Contains the name of the instance of Microsoft SQL Server Analysis Services on which the login event occurred.
CurrentTime	Contains the current time of the login event. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
NTCanonicalUserName	Contains the Windows user name associated with the login event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.
NTUserName	Contains the Windows user name associated with the login event.
StartTime	Contains the time (if available) at which the login event started. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
Error	Contains the error number of any error associated with the login event.
Severity	Contains the severity level of an exception associated with the login event. Values are: 0 = Success 1 = Informational 2 = Warning 3 = Error
Success	Contains the success or failure of the login event. Values are: 0 = Failure 1 = Success
ApplicationName	Contains the name of the client application associated with the login event.
ClientHostName	Contains the name of the computer at which the login event occurred.
ClientProcessID	Contains the client process ID associated with the login event.
NTDomainName	Contains the Windows domain account associated with the login event.

Audit Backup/Restore Event Class—Data Columns

Data Column	Description
ConnectionID	Contains the unique connection ID associated with the backup or restore event.
TextData	Contains the text data associated with the backup or restore event.
ServerName	Contains the name of the Analysis Services instance on which the backup or restore event occurred.
DatabaseName	Contains the name of the database in which the backup or restore statement is running.
EventSubclass	Contains the class of event within Analysis Services backup or restore events. Values are: 1 = Backup 2 = Restore 3 = Sync
NTCanonicalUserName	Contains the Windows user name associated with the backup or restore event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.
NTUserName	Contains the Windows user name associated with the backup or restore event.
SPID	Contains the server process ID (SPID) that uniquely identifies the user session associated with the backup or restore event. The SPID directly corresponds to the session GUID used by XML for Analysis (XMLA).
Error	Contains the error number of any error associated with the backup or restore event.
Severity	Contains the severity level of an exception associated with the login event. Values are: 0 = Success 1 = Informational 2 = Warning 3 = Error
Success	Contains the success or failure of the backup or restore event. Values are: 0 = Failure 1 = Success
ApplicationName	Contains the name of the client application associated with the backup or restore event.
ClientHostName	Contains the name of the computer at which the backup or restore event occurred.
ClientProcessID	Contains the client process ID associated with the backup or restore event.
NTDomainName	Contains the Windows domain account associated with the backup or restore event.
SessionID	Contains the session ID associated with the backup or restore event.

Audit Logout Event Class—Data Columns

Data Column	Description
ConnectionID	Contains the unique connection ID associated with the logout event.
ServerName	Contains the name of the instance of Analysis Services on which the logout event occurred.
CurrentTime	Contains the current time of the logout event. For filtering, expected formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
Duration	Contains the length of time between the login event and the logout event.
EndTime	Contains the time at which the logout event occurred. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
NTCanonicalUserName	Contains the Windows user name associated with the logout event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.
NTUserName	Contains the Windows user name associated with the logout event.
CPUTime	Contains the amount of CPU time (in milliseconds) used by the process between the time of the login event and the logout event.
Success	Contains the success or failure of the audit logout event. Values are: 0 = Failure 1 = Success
ApplicationName	Contains the name of the client application associated with the logout event.
ClientHostName	Contains the name of the computer at which the logout event occurred.
ClientProcessID	Contains the client process ID associated with the logout event.
NTDomainName	Contains the Windows domain account associated with the logout event.

Audit Server Starts and Stops Event Class—Data Columns

Data Column	Description
TextData	Contains the text data associated with the server start or stop event.
ServerName	Contains the name of the instance of Analysis Services on which the server start or stop event occurred.
CurrentTime	Contains the current time of the server start or stop event. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.
EventSubclass	Contains the class of event within the server start or stop event. Values are: 1 = Instance Shutdown 2 = Instance Started 3 = Instance Pause 4 = Instance Continued
Error	Contains the error number of any error associated with the server start or stop event.
Severity	Contains the severity level of an exception associated with the server start or stop event. Values are: 0 = Success 1 = Informational 2 = Warning 3 = Error
Success	Contains the success or failure of the server start or stop event. Values are: 0 = Failure 1 = Success

Audit Object Permission Event Class—Data Columns

Data Column	Description
ConnectionID	Contains the unique connection ID associated with the object permission event.
TextData	Contains the text data associated with the object permission event.
ServerName	Contains the name of the instance of Analysis Services on which the object permission event occurred.
DatabaseName	Contains the name of the database in which the object permission event occurred.
NTCanonicalUserName	Contains the Windows user name associated with the object permission event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.
NTUserName	Contains the Windows user name associated with the object permission event.
ObjectID	Contains the object ID (a string) associated with the object permission event.
ObjectName	Contains the name of the object associated with the object permission event.
ObjectPath	Contains the object path for the object associated with the object permission event, as a comma separated list of parents starting with the object's parents.
ObjectReference	Contains the object reference for the object permission event, encoded as XML for all parents and using tags to describe the object.
ObjectType	Contains the type of object associated with the object permission event
SPID	Contains the server process ID (SPID) that uniquely identifies the user session associated with the object permission event. The SPID directly corresponds to the session GUID used by XML for Analysis (XMLA).
Error	Contains the error number of any error associated the object permission event.
Severity	Contains the severity level of an exception associated the object permission event. Values are: 0 = Success 1 = Informational 2 = Warning 3 = Error
Success	Contains the success or failure of the object permission event. Values are: 0 = Failure 1 = Success
ApplicationName	Contains the name of the client application associated with the object permission event.
ClientHostName	Contains the name of the computer at which the object permission event occurred.
ClientProcessID	Contains the client process ID associated with the object permission event.
NTDomainName	Contains the Windows domain account associated with the object permission event.
SessionID	Contains the session ID associated with the object permission event.

See Also

Other Resources

Security Audit Event Category