Skip to content

Instantly share code, notes, and snippets.

@SQLDBAWithABeard
Last active March 31, 2020 11:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save SQLDBAWithABeard/07091a0a0e07d64933c15a36b102f9db to your computer and use it in GitHub Desktop.
Save SQLDBAWithABeard/07091a0a0e07d64933c15a36b102f9db to your computer and use it in GitHub Desktop.
Notebooks
CREATE EVENT SESSION [MonitorWindowsLogins] ON SERVER
ADD EVENT sqlserver.login(
ACTION(sqlserver.client_hostname,sqlserver.database_name,sqlserver.session_id,sqlserver.session_nt_username,sqlserver.session_server_principal_name)
WHERE ([sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_nt_user],N'')
AND [sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_server_principal_name],N'THEBEARD\gsartori')
AND [sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_server_principal_name],N'THEBEARD\wdurkin')
AND [sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_server_principal_name],N'THEBEARD\Rob')
AND [sqlserver].[session_nt_user]<>N'THEBEARD\gfritchey'
AND [sqlserver].[session_server_principal_name]<>N'THEBEARD\SQL_SVC'
AND [sqlserver].[session_server_principal_name]<>N'THEBEARD\SQL2014SER12R2$'))
ADD TARGET package0.event_file(SET filename=N'MonitorWindowsLogins'),
ADD TARGET package0.histogram(SET filtering_event_name=N'sqlserver.login',source=N'sqlserver.session_server_principal_name')
WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=ON,STARTUP_STATE=ON)
GO
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment