关键词：
## Why It Is Important
Unauthorized SQL database changes, such as deletions and creations, are always adverse events. Deletions can frustrate users and make them unable to find the information they need. Creations may also be troublesome for IT departments because they decrease the amount of free space on a server. Early detection of unauthorized changes may help IT departments avoid hours of troubleshooting.
## Native Auditing
1.- Run MS SQL Management Studio → Connect to the database you want to audit → Click “New Query” → Copy the following code into “New Query” box:
```Sql
DECLARE @RC int, @TraceID int, @on BIT
EXEC @rc = sp_trace_create @TraceID output, 2, N'C:\path\file'
SELECT RC = @RC, TraceID = @TraceID
-- Follow Common SQL trace event list and common sql trace
-- tables to define which events and table you want to capture
SELECT @on = 1
EXEC sp_trace_setevent @TraceID, 128, 1, @on
-- (128-Event Audit Database Management Event, 1-TextData table column)
EXEC sp_trace_setevent @TraceID, 128, 11, @on
EXEC sp_trace_setevent @TraceID, 128, 14, @on
EXEC sp_trace_setevent @TraceID, 128, 35, @on
EXEC @RC = sp_trace_setstatus @TraceID, 1
GO
```
2.- Define file trace location(marked red) and hit “Execute” to start a new trace.
3.- Execute this query to stop the trace when you want to audit data:
```Sq
sp_trace_setstatus @traceid = 1, @status = 0
```
4.- Execute this query in order to import the trace into a database table:
```Sq
USE DBname
SELECT * INTO tablename FROM ::fn_trace_gettable('C:\path\file.trc', DEFAULT)
GO
```
5.- Execute this query in order to view top 1000 rows of trace data:
```Sq
SELECT TOP 1000 [TextData] ,[HostName] ,[LoginName] ,[StartTime] ,[EndTime] ,[ServerName] ,[EventClass]
FROM [DBname].[dbo].[tablename]
WHERE DBname.dbo.tablename.TextData IS NOT NULL
```
6.- Inspect “TextData” column for an event: CREATE DATABASE, Drop Database, Alter Database in order to know what database was changed. To find out who changed it refer to “LoginName” column, and “StartTime” to know when.
Jump
Real Life Use Case
<a href="https://www.youtube.com/watch?v=oWhUoydZWBM
" target="_blank"><img src="http://img.youtube.com/vi/oWhUoydZWBM/0.jpg"
alt="IMAGE ALT TEXT HERE" width="240" height="180" border="10" /></a>
Credits
Originally posted - https://www.netwrix.com/how_to_detect_changes_in_sql_database.html Jump Jump
如何检测markdown的代码语言？
】如何检测markdown的代码语言？【英文标题】：Howtodetectcodelanguageformarkdown?【发布时间】：2016-12-2612:41:28【问题描述】：我已经在文本区域中写了：```rubyputs\'helloword!\'```我不会得到：<prelang=\'ruby\'><code>putshelloword!</code&g... 查看详情
markdown如何更改主分区(代码片段)
查看详情
markdown如何更改库的rpath(代码片段)
查看详情
检测 SQL 数据库更改
】检测SQL数据库更改【英文标题】：DetectSQLdatabasechanges【发布时间】：2014-10-2911:34:13【问题描述】：考虑这个例子：INSERTINTO[Table](column1)SELECTvalue1如果我要在SSMS中执行此命令，对于c#表单应用程序，我需要做什么才能识别此事件... 查看详情
markdown如何更改绝对定位的css元素的偏移父元素？(代码片段)
查看详情
Xamarin 表单 - Webview 检测 URL 更改
...，当用户在webview中处理支付时，它会重定向到example.com。如何构建我的代码以自动检测webviewurl是否更改为example.com？这是我的xaml代码：&l 查看详情
markdown如何通过命令行在linux或macos中更改mysqlroot密码(代码片段)
查看详情
markdown如何在git中更改提交消息？-首次发表于fullweb.io第55期(代码片段)
查看详情
markdown如何在git中更改提交消息？-首次发表于fullweb.io第55期(代码片段)
查看详情
如何检测哪个 div 在更改时处于活动状态？
】如何检测哪个div在更改时处于活动状态？【英文标题】：Howtodetectwhichdivisactiveonchange?【发布时间】：2015-02-1815:43:04【问题描述】：我有以下DOM结构：<divclass=”wrapperactive”><p>content</p></div><divclass=”wrapper”&g... 查看详情
markdown差错检测(代码片段)
查看详情
markdown检测密钥(代码片段)
查看详情
markdown异议检测(代码片段)
查看详情
如何在 FPNTextField 中检测国家代码和更改标志
】如何在FPNTextField中检测国家代码和更改标志【英文标题】：HowtodetectthecountrycodeandchangeflaginFPNTextField【发布时间】：2020-09-1010:05:41【问题描述】：我正在使用FlagPhonenoPod使用以下代码搜索或选择带有标志的国家代码。但是当谈到... 查看详情
markdown差异检测算法(代码片段)
查看详情
markdown人脸模糊检测(代码片段)
查看详情
markdown检测woocommerce(代码片段)
查看详情
markdown检测对象类型(代码片段)
查看详情