Read-SqlXEvent

  • 參考
模組:
SQLServer

從 XEL 檔案或即時 SQL XEvent 會話讀取SQL Server XEvent。

Syntax

Read-SqlXEvent
    [-FileName] <String>
    [<CommonParameters>]
Read-SqlXEvent
    -ConnectionString <String>
    -SessionName <String>
    [<CommonParameters>]

Description

Read-SqlXEvent會從檔案或即時 SQL XEvent 會話讀取SQL Server XEvent。 XEvent 會話是由 CREATE EVENT SESSION Transact-SQL API 所建立。 SQL XEvent 檔案通常具有 。XEL 或 .sqlaudit 延伸模組，並包含 XEvents 的資料流程。 XEvents 的結構是在會話組態中定義。 SQL 即時串流可透過 SQL TDS 通訊協定取得，而且需要針對產生它們的伺服器進行驗證。

New in v22: if you are using the -ConnectionString parameter, you may get an error like "The certificate chain was issued by an authority that is not trusted." This is because the new SQL driver changed its default to something more secure. Either make sure you configure your server properly, or install/trust the certificate; alternatively (not recommended), you can pass Encrypt=Optional or TrustServerCertificate=true in the connection string to go back to the behavior that existed in v21 of the module.

範例

範例 1：讀取和剖析 sqlaudit 檔案。 傳回的每個物件都會包含來自單一稽核記錄的所有資訊。

Read-SqlXEvent -FileName C:\audits\Audit-20190529-132659.sqlaudit

# The output would look like this:
#
# Name      : audit_event
# UUID      : c6479a6f-f1bd-4759-9881-fcb493821aff
# Timestamp : 6/13/2019 7:49:42 AM +00:00
# Fields    : {[audit_schema_version, 1], [event_time, 6/13/2019 7:49:42 AM +00:00], [sequence_number, 1], [action_id,
#             1129534785]...}
# Actions   : {}
#
# Name      : audit_event
# UUID      : c6479a6f-f1bd-4759-9881-fcb493821aff
# Timestamp : 6/13/2019 12:42:28 PM +00:00
# Fields    : {[audit_schema_version, 1], [event_time, 6/13/2019 12:42:28 PM +00:00], [sequence_number, 1], [action_id,
#             1129534785]...}
# Actions   : {}
# ...

範例 2：從與Windows 驗證連線之同一部電腦上執行的SQL Server讀取和剖析 XEvent 的即時串流。 傳回的每個物件都會包含來自單一 XEvent 記錄的所有資訊。

Read-SQLXEvent -ConnectionString "Server=.;Database=master;Trusted_Connection=True" -SessionName telemetry_xevents

# The output would look like this:
#
# Name      : auto_stats
# UUID      : 9237e17a-a73d-4832-8936-f319e19e219b
# Timestamp : 11/14/2022 5:31:12 AM +00:00
# Fields    : {[database_id, 1], [object_id, 74], [index_id, 1], [job_id, 0]…}
# Actions   : {}
# 
# Name      : auto_stats
# UUID      : 9237e17a-a73d-4832-8936-f319e19e219b
# Timestamp : 11/14/2022 5:31:12 AM +00:00
# Fields    : {[database_id, 1], [object_id, 74], [index_id, 17], [job_id, 0]…}
# Actions   : {}
# ...

參數

-ConnectionString

SQL Server連接字串。

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

-FileName

要讀取之 XEvent 檔案的檔案名。

Type:String
Position:0
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-SessionName

SQL SERVER XEvent 會話名稱，如 CREATE EVENT SESSION Transact-SQL 所定義。

Type:String
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False

輸入

System.String

輸出

Microsoft.SqlServer.XEvent.XELite.IXEvent