Query Exercise: Who’s Changing the Table?

CreateExtendedEventSession.sql

create event session StackOverflow
on server
add event sqlserver.rpc_starting
(
    set collect_statement = (1)
    action
    (
        package0.event_sequence,
        sqlserver.client_hostname,
        sqlserver.database_name,
        sqlserver.sql_text,
        sqlserver.session_id
    )
    where
    (
            package0.equal_boolean(sqlserver.is_system, (0))
        and sqlserver.database_name = N'StackOverflow'
        and
        (
            sqlserver.like_i_sql_unicode_string(statement, N'%update%Users%set%AboutMe%')
            or sqlserver.like_i_sql_unicode_string(statement, N'%insert%Users%')
        )
    )
),
add event sqlserver.sql_batch_starting
(
    action
    (
        package0.event_sequence,
        sqlserver.client_hostname,
        sqlserver.database_name,
        sqlserver.sql_text,
        sqlserver.session_id
    )
    where
    (
            package0.equal_boolean(sqlserver.is_system, (0))
        and sqlserver.database_name = N'StackOverflow'
        and
        (
            sqlserver.like_i_sql_unicode_string(statement, N'%update%Users%set%AboutMe%')
            or sqlserver.like_i_sql_unicode_string(statement, N'%insert%Users%')
        )
    )
)
add target package0.event_file
(
    set filename = N'D:\StackOverflow.xel',
    max_file_size = 2048,
    max_rollover_files = 1
)
with
(
    max_memory = 8192KB,
    event_retention_mode = allow_single_event_loss,
    max_dispatch_latency = 30 seconds,
    max_event_Size = 0KB,
    memory_partition_mode = none,
    track_causality = on,
    startup_state = on
)
go

alter event session StackOverflow
on server
state = start
go

QueryExtendedEventSession.sql

select *
from sys.fn_xe_file_target_read_file('D:\StackOverflow*.xel', null, null, null)