TechNet
Export (0) Print
Expand All
Collapse the table of content
Expand the table of content
Expand Minimize

Audit Database Mirroring Login Event Class

 

Applies To: SQL Server 2016

SQL Server creates an Audit Database Mirroring Login event to report audit messages related to database mirroring transport security.

Data columnTypeDescriptionColumn numberFilterable
ApplicationNamenvarcharUnused in this event class.10Yes
ClientProcessIDintUnused in this event class.9Yes
DatabaseIDintSQL Server Profiler displays the name of the database if the ServerName data column is captured in the trace and the server is available. Determine the value for a database by using the DB_ID function.3Yes
EventClassintThe type of event class captured. Always 154 for Audit Database Mirroring Login.27No
EventSequenceintSequence number for this event.51No
EventSubClassintThe type of event subclass, providing further information about each event class. The table below lists the event subclass values for this event.21Yes
FileNamenvarcharSupported authentication method configured on the remote database mirroring endpoint. When more than one method is available, the accepting (target) endpoint determines which method is tried first. Possible values are:

 

 None. No authentication method is configured.

 NTLM. Requires NTLM authentication.

 KERBEROS. Requires Kerberos authentication.

 NEGOTIATE. Windows negotiates the authentication method.

 CERTIFICATE. Requires the certificate configured for the endpoint, which is stored in the master database.

 NTLM, CERTIFICATE. Accepts NTLM or the endpoint certificate for authentication.

 KERBEROS, CERTIFICATE. Accepts Kerberos or the endpoint certificate for authentication.

 NEGOTIATE, CERTIFICATE. Windows negotiates the authentication method, or an endpoint certificate can be used for authentication.

 CERTIFICATE, NTLM. Accepts an endpoint certificate or NTLM for authentication.

 CERTIFICATE, KERBEROS. Accepts an endpoint certificate or Kerberos for authentication.

 CERTIFICATE, NEGOTIATE. Accepts an endpoint certificate for authentication or Windows negotiates the authentication method.
36No
HostNamenvarcharUnused in this event class.8Yes
IsSystemintIndicates whether the event occurred on a system process or a user process. 1 = system, 0 = user.60No
LoginSidimageThe security identification number (SID) of the logged-in user. Each SID is unique for each login in the server.41Yes
NTDomainNamenvarcharThe Windows domain to which the user belongs.7Yes
NTUserNamenvarcharThe name of the user that owns the connection that generated this event.6Yes
ObjectNamenvarcharThe connect string used for this connection.34No
OwnerNamenvarcharSupported authentication method configured on the local database mirroring endpoint. When more than one method is available, the accepting (target) endpoint determines which method is tried first. Possible values are:

 

 None. No authentication method is configured.

 NTLM. Requires NTLM authentication.

 KERBEROS. Requires Kerberos authentication.

 NEGOTIATE. Windows negotiates the authentication method.

 CERTIFICATE. Requires the certificate configured for the endpoint, which is stored in the master database.

 NTLM, CERTIFICATE. Accepts NTLM or the endpoint certificate for authentication.

 KERBEROS, CERTIFICATE. Accepts Kerberos or the endpoint certificate for authentication.

 NEGOTIATE, CERTIFICATE. Windows negotiates the authentication method or an endpoint certificate can be used for authentication.

 CERTIFICATE, NTLM. Accepts an endpoint certificate or NTLM for authentication.

 CERTIFICATE, KERBEROS. Accepts an endpoint certificate or Kerberos for authentication.

 CERTIFICATE, NEGOTIATE. Accepts an endpoint certificate for authentication or Windows negotiates the authentication method.
37No
ProviderNamenvarcharThe authentication method used for this connection.46No
RoleNamenvarcharThe role of the connection. This is either initiator or target.38No
ServerNamenvarcharThe name of the instance of SQL Server being traced.26No
SPIDintThe server process ID assigned by SQL Server to the process associated with the client.12Yes
StartTimedatetimeThe time at which the event started, when available.14Yes
StateintIndicates the location within the SQL Server source code that produced the event. Each location that may produce this event has a different state code. A Microsoft support engineer can use this state code to find where the event was produced.30No
TargetUserNamenvarcharLogin state. One of:

 INITIAL

 WAIT LOGIN NEGOTIATE

 ONE ISC

 ONE ASC

 TWO ISC

 TWO ASC

 WAIT ISC Confirm

 WAIT ASC Confirm

 WAIT REJECT

 WAIT PRE-MASTER SECRET

 WAIT VALIDATION

 WAIT ARBITRATION

 ONLINE

 ERROR

 

Note: ISC = Initiate Security Context. ASC = Accept Security Context.
39No
TransactionIDbigintThe system-assigned ID of the transaction.4No

The table below lists the subclass values for this event class.

IDSubclassDescription
1Login SuccessA Login Success event reports that the adjacent database mirroring login process has finished successfully.
2Login Protocol ErrorA Login Protocol Error event reports that the database mirroring login receives a message that is well-formed but not valid for the current state of the login process. The message may have been lost or sent out-of-sequence.
3Message Format ErrorA Message Format Error event reports that the database mirroring login received a message that does not match the expected format. The message may have been corrupted, or a program other than SQL Server may be sending messages to the port that database mirroring uses.
4Negotiate FailureA Negotiate Failure event reports that the local database mirroring endpoint and the remote database mirroring endpoint support mutually exclusive levels of authentication.
5Authentication FailureAn Authentication Failure event reports that a database mirroring endpoint cannot perform authentication for the connection due to an error. For Windows Authentication, this event reports that the database mirroring endpoint is unable to use Windows Authentication. For certificate-based authentication, this event reports that the database mirroring endpoint is unable to access the certificate.
6Authorization FailureAn Authorization Failure event reports that a database mirroring endpoint denied authorization for the connection. For Windows Authentication, this event reports that the security identifier for the connection does not match a database user. For certificate-based authentication, this event reports that the public key delivered in the message does not correspond to a certificate in the master database.

CREATE ENDPOINT (Transact-SQL)
ALTER ENDPOINT (Transact-SQL)
Database Mirroring (SQL Server)

Community Additions

ADD
Show:
© 2016 Microsoft