Security Audit Event Category (SQL Server Profiler)

 

Applies To: SQL Server 2016

The Security Audit event category contains security audit events.

TopicDescription
Audit Add DB User Event ClassIndicates that a login has been added or removed as a database user to a database.
Audit Add Login to Server Role Event ClassIndicates that a login was added or removed from a fixed server role.
Audit Add Member to DB Role Event ClassIndicates that a login has been added to or removed from a role.
Audit Add Role Event ClassIndicates that a database role was added to or removed from a database.
Audit Addlogin Event ClassIndicates that a login has been added or removed.
Audit App Role Change Password Event ClassIndicates that a password has been changed for an application role.
Audit Backup and Restore Event ClassIndicates that a backup or restore statement has been issued.
Audit Broker Conversation Event ClassReports audit messages related to Service Broker dialog security.
Audit Broker Login Event ClassReports audit messages related to Service Broker transport security.
Audit Change Audit Event ClassIndicates that an audit trace modification has been made.
Audit Change Database Owner Event ClassIndicates that the permissions to change the owner of a database have been checked.
Audit Database Management Event ClassIndicates that a database has been created, altered, or dropped.
Audit Database Mirroring Login Event ClassReports audit messages related to database mirroring transport security.
Audit Database Object Access Event ClassIndicates that a database object, such as a schema, has been accessed.
Audit Database Object GDR Event ClassIndicates that a GDR event for a database object has occurred.
Audit Database Object Management Event ClassIndicates that a CREATE, ALTER, or DROP statement was executed on a database object.
Audit Database Object Take Ownership Event ClassIndicates that there has been a change of owner for objects in database scope.
Audit Database Operation Event ClassIndicates that various operations such as checkpoint or subscribe query notification have occurred.
Audit Database Principal Impersonation Event ClassIndicates that an impersonation has occurred within the database scope.
Audit Database Principal Management Event ClassIndicates that principals have been created, altered, or dropped from a database.
Audit Database Scope GDR Event ClassIndicates that a GRANT, REVOKE, or DENY has been issued for a statement permission by a user in Microsoft SQL Server.
Audit DBCC Event ClassIndicates that a DBCC command has been issued.
Audit Fulltext Event ClassIndicates that a full-text event has occured.
Audit Login Change Password Event ClassIndicates that a user has changed their SQL Server login password.
Audit Login Change Property Event ClassIndicates that sp_defaultdb, sp_defaultlanguage, or ALTER LOGIN was used to modify a property of a login.
Audit Login Event ClassIndicates that a user has successfully logged into SQL Server.
Audit Login Failed Event ClassIndicates that a user attempted to log in to SQL Server and failed.
Audit Login GDR Event ClassIndicates that a Microsoft Windows login right was added or removed.
Audit Logout Event ClassIndicates that a user has logged out of SQL Server.
Audit Object Derived Permission Event ClassIndicates that a CREATE, ALTER, or DROP was issued for an object.
Audit Schema Object Access Event ClassIndicates that an object permission (such as SELECT) has been used.
Audit Schema Object GDR Event ClassIndicates that a GRANT, REVOKE, or DENY was issued for a schema object permission by a user in SQL Server.
Audit Schema Object Management Event ClassIndicates that a server object has been created, altered, or dropped.
Audit Schema Object Take Ownership Event ClassIndicates that the permissions to change the owner of schema object have been checked.
Audit Server Alter Trace Event ClassIndicates that the ALTER TRACE permission has been checked.
Audit Server Object GDR Event ClassIndicates that a GDR event for a schema object has occurred.
Audit Server Object Management Event ClassIndicates that a CREATE, ALTER, or DROP event has occurred for a server object.
Audit Server Object Take Ownership Event ClassIndicates that a server object owner has changed.
Audit Server Operation Event ClassIndicates that Audit operations have occurred in the server.
Audit Server Principal Impersonation Event ClassIndicates that an impersonation has occurred within the server scope.
Audit Server Principal Management Event ClassIndicates that a CREATE, ALTER, or DROP has occurred for a server principal.
Audit Server Scope GDR Event ClassIndicates that a GDR event has occurred for server permissions.
Audit Server Starts and Stops Event ClassIndicates that the SQL Server service state has been modified.
Audit Statement Permission Event ClassIndicates that a statement permission has been used.

Extended Events

Community Additions

ADD
Show: