Auditing Categories - Implementing Database Security and Auditing - page 361

In SQL Server you can use either auditing features or trace features. If
you choose to use traces, you need to set up the appropriate events that are
relevant to errors using

. These include the event IDs

sp_trace_event

shown in Table 12.1:

Table 12.1 Event IDs and description relevant to error audits

Event ID Event Class Description

16

Attention Collects all attention events, such as client-

interrupt requests or when a client connec-
tion is broken.

21

ErrorLog Error events have been logged in the error

log.

22

EventLog Events have been logged in the application

log.

33

Exception Exception has occurred in the server.

67

Execution Warnings Any warnings that occurred during the exe-

cution of a server statement or stored proce-
dure.

55

Hash Warning Hashing operation may have encountered a

problem.

79

Missing Column Statis-
tics

Column statistics for the query optimizer are
not available.

80

Missing Join Predicate Executing query has no join predicate. This

can result in a long-running query.

61

OLEDB Errors OLE DB error has occurred.

Multiple DB2 event monitors are relevant to error audits, and you may
have to use a number of these types. For each that you feel is needed, you
will need to filter those records that are related to errors. For example, you
should select CHECKING events for ACCESS DENIED records and look
at AUTHENTICATE_PASSWORD and VALIDATE_USER events in the
VALIDATE category.
Although error logging and auditing are possible in some environments,
this is one of the areas in which an external auditing system really shines
(especially one that is based on inspecting all requests and responses, as
described in Section 13.3). If you monitor all incoming SQL calls and all

responses, tracking and reporting all errors is simple and does not put any