数据库审计

DROP SERVER AUDIT testAudit
-- Create Server Audit object
USE master
CREATE SERVER AUDIT testAudit TO FILE(FILEPATH='C:\SelectAudit\')
GO

-- Create an audit specification
USE qanholas
GO
CREATE DATABASE AUDIT SPECIFICATION testAudSpec FOR SERVER AUDIT testAudit
ADD (SELECT ON dbo.ip BY Public)
GO

-- Verify Audit objects if turned on (1 = Enabled)
USE master
SELECT is_state_enabled,* FROM sys.server_file_audits
USE qanholas
SELECT is_state_enabled,* FROM sys.database_audit_specifications
GO

-- Turn on Audit
USE master
ALTER SERVER AUDIT testAudit WITH (STATE=ON)
GO
USE qanholas
ALTER DATABASE AUDIT SPECIFICATION testAudSpec WITH (STATE=ON)
GO

SELECT session_server_principal_name, statement, *
FROM fn_get_audit_file ('C:\SelectAudit\*',NULL, NULL)



SELECT  TOP 100 *  FROM ip

查询测试

审计文件