Trojans - Implementing Database Security and Auditing - page 284

Table 9.1 Available events in the SQL Server trace mechanism (continued)

Event
number Event name Description

103

Audit Object GDR Occurs every time a GRANT, DENY, REVOKE for an object per-

mission is issued by any user in SQL Server.

104

Audit Add/Drop Login Occurs when a SQL Server login is added or removed; for

sp_addlogin and sp_droplogin.

105

Audit Login GDR Occurs when a Microsoft Windows login right is added or removed;

for sp_grantlogin, sp_revokelogin, and sp_denylogin.

106

Audit Login Change Prop-
erty

Occurs when a property of a login, except passwords, is modified;
for sp_defaultdb and sp_defaultlanguage.

107

Audit Login Change Pass-
word

Occurs when a SQL Server login password is changed.
Passwords are not recorded.

108

Audit Add Login to Server
Role

Occurs when a login is added or removed from a fixed server role;
for sp_addsrvrolemember and sp_dropsrvrolemember.

109

Audit Add DB User Occurs when a login is added or removed as a database user (Win-

dows or SQL Server) to a database; for sp_grantdbaccess,
sp_revokedbaccess, sp_adduser, and sp_dropuser.

110

Audit Add Member to DB Occurs when a login is added or removed as a database user (fixed or

user-defined) to a database; for sp_addrolemember,
sp_droprolemember, and sp_changegroup.

111

Audit Add/Drop Role Occurs when a login is added or removed as a database user to a

database; for sp_addrole and sp_droprole.

112

App Role Pass Change Occurs when a password of an application role is changed.

113

Audit Statement Permission Occurs when a statement permission (such as CREATE TABLE) is

used.

114

Audit Object Permission Occurs when an object permission (such as SELECT) is used, both

successfully or unsuccessfully.

115

Audit Backup/Restore Occurs when a BACKUP or RESTORE command is issued.

116

Audit DBCC Occurs when DBCC commands are issued.

117

Audit Change Audit Occurs when audit trace modifications are made.

118

Audit Object Derived Per-
mission

Occurs when CREATE, ALTER, and DROP object commands are
issued.