It is possible and safe to monitor a table DML history on sqlserver

Posted 2021-03-09 怕提神

He is my test step:


In a test enviroument, I make a table "test"/

demo table:
create table test ( a nvharchar(100));

trigger record table:
CREATE TABLE [dbo].[DMLEvents](
[EventDate] [datetime] NOT NULL DEFAULT (getdate()),
[EventType] [nvarchar](64) NULL,
[EventDML] [nvarchar](max) NULL,
[EventXML] [xml] NULL,
[DatabaseName] [nvarchar](255) NULL,
[SchemaName] [nvarchar](255) NULL,
[ObjectName] [nvarchar](max) NULL,
[HostName] [varchar](64) NULL,
[IPAddress] [varchar](32) NULL,
[ProgramName] [nvarchar](255) NULL,
[LoginName] [nvarchar](255) NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
GO

DML trigger for that table:
create or alter TRIGGER [dbo].[DMLTrigger_Sample]
ON [dbo].[test]
after INSERT,delete,update

AS
BEGIN
SET NOCOUNT ON;
SET ANSI_WARNINGS OFF;
DECLARE
@EventData XML = EVENTDATA();

DECLARE
@ip VARCHAR(32) =
(
SELECT client_net_address
FROM sys.dm_exec_connections
WHERE session_id = @@SPID
);


DECLARE
@SQL1 VARCHAR(MAX) =
(
select t.text
from sys.sysprocesses
cross apply sys.dm_exec_sql_text (sql_handle) t
where spid=@@SPID
);


INSERT dbo.DMLEvents
(
-- EventType,
-- EventDML,
-- EventXML,
DatabaseName,
-- SchemaName,
ObjectName,
HostName,
IPAddress,
ProgramName,
LoginName
)
SELECT
-- @EventData.value(\'(/EVENT_INSTANCE/typedesc)[1]\', \'NVARCHAR(100)\'),
-- @EventData.value(\'(/EVENT_INSTANCE/TSQLCommand)[1]\', \'NVARCHAR(MAX)\'),
-- @EventData,
DB_NAME(),
-- @EventData.value(\'(/EVENT_INSTANCE/SchemaName)[1]\', \'NVARCHAR(255)\'),
-- @EventData.value(\'(/EVENT_INSTANCE/ObjectName)[1]\', \'NVARCHAR(255)\'),
@SQL1,
HOST_NAME(),
@ip,
PROGRAM_NAME(),
SUSER_SNAME();
END

GO


We have to contine:

instance audit

CREATE SERVER AUDIT [OurAudit]
TO FILE
( FILEPATH = N\'C:\\mssql_audit\\\'
,MAXSIZE = 0 MB
,MAX_ROLLOVER_FILES = 2147483647
,RESERVE_DISK_SPACE = OFF
)
WITH
( QUEUE_DELAY = 1000
,ON_FAILURE = CONTINUE
,AUDIT_GUID = \'747fc00d-2745-4705-9a94-6c9fb6dea9bc\'
)
ALTER SERVER AUDIT [OurAudit] WITH (STATE = ON)
GO

special database special table audit:

CREATE DATABASE AUDIT SPECIFICATION [OurAudit_test]
FOR SERVER AUDIT [OurAudit]
ADD (DELETE ON OBJECT::[dbo].[test] BY [public]),
ADD (INSERT ON OBJECT::[dbo].[test] BY [public]),
ADD (UPDATE ON OBJECT::[dbo].[test] BY [public])
WITH (STATE = ON)
GO

Here we begin:

(1) insert an demo date

insert into test values (\'ghgh\')
select * from test
result is


a
ghgh

(2) select audit record:
select * from [DMLEvents]
----
SELECT DATEADD(hh, DATEDIFF(hh, GETUTCDATE(), CURRENT_TIMESTAMP), event_time )
as corrected_time,
action_id ,
session_server_principal_name,
server_instance_name ,
database_name ,
schema_name ,
object_name ,
statement ,
file_name FROM fn_get_audit_file( \'C:\\mssql_audit\\OurAudit_*.sqlaudit\' , DEFAULT , DEFAULT);

what can I see ?