Share via


Security Audit Data Columns

The Security Audit event category has the following event classes:

  • Audit Login class

  • Audit Backup/Restore Event class

  • Audit Logout class

  • Audit Server Starts and Stops class

  • Audit Object Permission Event class

The following tables list the data columns for each of these event classes.

Audit Login Event Class—Data Columns

Data Column

Description

ConnectionID

Contains the unique connection ID associated with the login event.

ServerName

Contains the name of the instance of Microsoft SQL Server Analysis Services on which the login event occurred.

CurrentTime

Contains the current time of the login event. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.

NTCanonicalUserName

Contains the Windows user name associated with the login event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.

NTUserName

Contains the Windows user name associated with the login event.

StartTime

Contains the time (if available) at which the login event started. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.

Error

Contains the error number of any error associated with the login event.

Severity

Contains the severity level of an exception associated with the login event. Values are:

0 = Success

1 = Informational

2 = Warning

3 = Error

Success

Contains the success or failure of the login event. Values are:

0 = Failure

1 = Success

ApplicationName

Contains the name of the client application associated with the login event.

ClientHostName

Contains the name of the computer at which the login event occurred.

ClientProcessID

Contains the client process ID associated with the login event.

NTDomainName

Contains the Windows domain account associated with the login event.

Audit Backup/Restore Event Class—Data Columns

Data Column

Description

ConnectionID

Contains the unique connection ID associated with the backup or restore event.

TextData

Contains the text data associated with the backup or restore event.

ServerName

Contains the name of the Analysis Services instance on which the backup or restore event occurred.

DatabaseName

Contains the name of the database in which the backup or restore statement is running.

EventSubclass

Contains the class of event within Analysis Services backup or restore events. Values are:

1 = Backup

2 = Restore

3 = Sync

NTCanonicalUserName

Contains the Windows user name associated with the backup or restore event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.

NTUserName

Contains the Windows user name associated with the backup or restore event.

SPID

Contains the server process ID (SPID) that uniquely identifies the user session associated with the backup or restore event. The SPID directly corresponds to the session GUID used by XML for Analysis (XMLA).

Error

Contains the error number of any error associated with the backup or restore event.

Severity

Contains the severity level of an exception associated with the login event. Values are:

0 = Success

1 = Informational

2 = Warning

3 = Error

Success

Contains the success or failure of the backup or restore event. Values are:

0 = Failure

1 = Success

ApplicationName

Contains the name of the client application associated with the backup or restore event.

ClientHostName

Contains the name of the computer at which the backup or restore event occurred.

ClientProcessID

Contains the client process ID associated with the backup or restore event.

NTDomainName

Contains the Windows domain account associated with the backup or restore event.

SessionID

Contains the session ID associated with the backup or restore event.

Audit Logout Event Class—Data Columns

Data Column

Description

ConnectionID

Contains the unique connection ID associated with the logout event.

ServerName

Contains the name of the instance of Analysis Services on which the logout event occurred.

CurrentTime

Contains the current time of the logout event. For filtering, expected formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.

Duration

Contains the length of time between the login event and the logout event.

EndTime

Contains the time at which the logout event occurred. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.

NTCanonicalUserName

Contains the Windows user name associated with the logout event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.

NTUserName

Contains the Windows user name associated with the logout event.

CPUTime

Contains the amount of CPU time (in milliseconds) used by the process between the time of the login event and the logout event.

Success

Contains the success or failure of the audit logout event. Values are:

0 = Failure

1 = Success

ApplicationName

Contains the name of the client application associated with the logout event.

ClientHostName

Contains the name of the computer at which the logout event occurred.

ClientProcessID

Contains the client process ID associated with the logout event.

NTDomainName

Contains the Windows domain account associated with the logout event.

Audit Server Starts and Stops Event Class—Data Columns

Data Column

Description

TextData

Contains the text data associated with the server start or stop event.

ServerName

Contains the name of the instance of Analysis Services on which the server start or stop event occurred.

CurrentTime

Contains the current time of the server start or stop event. For filtering, the formats are YYYY-MM-DD and YYYY-MM-DD HH:MM:SS.

EventSubclass

Contains the class of event within the server start or stop event. Values are:

1 = Instance Shutdown

2 = Instance Started

3 = Instance Pause

4 = Instance Continued

Error

Contains the error number of any error associated with the server start or stop event.

Severity

Contains the severity level of an exception associated with the server start or stop event. Values are:

0 = Success

1 = Informational

2 = Warning

3 = Error

Success

Contains the success or failure of the server start or stop event. Values are:

0 = Failure

1 = Success

Audit Object Permission Event Class—Data Columns

Data Column

Description

ConnectionID

Contains the unique connection ID associated with the object permission event.

TextData

Contains the text data associated with the object permission event.

ServerName

Contains the name of the instance of Analysis Services on which the object permission event occurred.

DatabaseName

Contains the name of the database in which the object permission event occurred.

NTCanonicalUserName

Contains the Windows user name associated with the object permission event. The user name is in canonical form. For example, engineering.microsoft.com/software/user.

NTUserName

Contains the Windows user name associated with the object permission event.

ObjectID

Contains the object ID (a string) associated with the object permission event.

ObjectName

Contains the name of the object associated with the object permission event.

ObjectPath

Contains the object path for the object associated with the object permission event, as a comma separated list of parents starting with the object's parents.

ObjectReference

Contains the object reference for the object permission event, encoded as XML for all parents and using tags to describe the object.

ObjectType

Contains the type of object associated with the object permission event

SPID

Contains the server process ID (SPID) that uniquely identifies the user session associated with the object permission event. The SPID directly corresponds to the session GUID used by XML for Analysis (XMLA).

Error

Contains the error number of any error associated the object permission event.

Severity

Contains the severity level of an exception associated the object permission event. Values are:

0 = Success

1 = Informational

2 = Warning

3 = Error

Success

Contains the success or failure of the object permission event. Values are:

0 = Failure

1 = Success

ApplicationName

Contains the name of the client application associated with the object permission event.

ClientHostName

Contains the name of the computer at which the object permission event occurred.

ClientProcessID

Contains the client process ID associated with the object permission event.

NTDomainName

Contains the Windows domain account associated with the object permission event.

SessionID

Contains the session ID associated with the object permission event.

See Also

Other Resources