bin/XEtemplates/Activity Tracking.xml
|
<event_sessions xmlns="http://schemas.microsoft.com/sqlserver/2008/07/extendedeventconfig">
<event_session name="Activity Tracking" maxMemory="4" eventRetentionMode="allowSingleEventLoss" trackCausality="true" dispatchLatency="30" maxEventSize="0" memoryPartitionMode="none"> <templateCategory> <!-- _locID_text="templateCategory" _locComment = "" -->System Monitoring</templateCategory> <templateName> <!-- _locID_text = "templateName" _locComment = "" -->Activity Tracking</templateName> <templateDescription> <!-- _locID_text = "templateDescription" _locComment = "" -->Similar to the 'Default Trace' that exists in the SQL Trace system. Use this template to track general activity on your system. The difference between this template and the 'Default Trace' is that this template does not include security audit events. If you would like to audit your system you should use the SQL Server Audit feature.</templateDescription> <event package="sqlserver" name="error_reported"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="sqlserver" name="database_id" /> <action package="sqlserver" name="database_name" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> <predicate> <or> <or> <or> <or> <leaf> <comparator name="equal_int64" package="package0"></comparator> <event name="error_reported" package="sqlserver" field="error_number"></event> <value>8957</value> </leaf> <leaf> <comparator name="equal_int64" package="package0"></comparator> <event name="error_reported" package="sqlserver" field="error_number"></event> <value>17550</value> </leaf> </or> <leaf> <comparator name="equal_int64" package="package0"></comparator> <event name="error_reported" package="sqlserver" field="error_number"></event> <value>17551</value> </leaf> </or> <leaf> <comparator name="equal_int64" package="package0"></comparator> <event name="error_reported" package="sqlserver" field="error_number"></event> <value>15457</value> </leaf> </or> <leaf> <comparator name="greater_than_int64" package="package0"></comparator> <event name="error_reported" package="sqlserver" field="severity"></event> <value>18</value> </leaf> </or> </predicate> </event> <event package="sqlserver" name="full_text_crawl_started"> <action package="sqlserver" name="database_id" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> </event> <event package="sqlserver" name="fulltextlog_written"> <action package="sqlserver" name="database_id" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> </event> <event package="sqlserver" name="hash_warning"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="sqlserver" name="database_id" /> <action package="sqlserver" name="database_name" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> </event> <event package="sqlserver" name="missing_column_statistics"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="sqlserver" name="database_id" /> <action package="sqlserver" name="database_name" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> </event> <event package="sqlserver" name="missing_join_predicate"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="sqlserver" name="database_id" /> <action package="sqlserver" name="database_name" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> </event> <event package="sqlserver" name="object_altered"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <parameter name="collect_database_name" value="1" /> <predicate> <or> <leaf> <comparator name="not_equal_uint64" package="package0"></comparator> <event name="object_altered" package="sqlserver" field="database_id"></event> <value>2</value> </leaf> <and> <leaf> <comparator name="greater_than_int64" package="package0"></comparator> <event name="object_altered" package="sqlserver" field="object_id"></event> <value>0</value> </leaf> <not> <leaf> <comparator name="like_i_sql_unicode_string" package="sqlserver"></comparator> <event name="object_altered" package="sqlserver" field="object_name"></event> <value><![CDATA[#%]]></value> </leaf> </not> </and> </or> </predicate> </event> <event package="sqlserver" name="object_created"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <parameter name="collect_database_name" value="1" /> <predicate> <or> <leaf> <comparator name="not_equal_uint64" package="package0"></comparator> <event name="object_created" package="sqlserver" field="database_id"></event> <value>2</value> </leaf> <and> <leaf> <comparator name="greater_than_int64" package="package0"></comparator> <event name="object_created" package="sqlserver" field="object_id"></event> <value>0</value> </leaf> <not> <leaf> <comparator name="like_i_sql_unicode_string" package="sqlserver"></comparator> <event name="object_created" package="sqlserver" field="object_name"></event> <value><![CDATA[#%]]></value> </leaf> </not> </and> </or> </predicate> </event> <event package="sqlserver" name="object_deleted"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <parameter name="collect_database_name" value="1" /> <predicate> <or> <leaf> <comparator name="not_equal_uint64" package="package0"></comparator> <event name="object_deleted" package="sqlserver" field="database_id"></event> <value>2</value> </leaf> <and> <leaf> <comparator name="greater_than_int64" package="package0"></comparator> <event name="object_deleted" package="sqlserver" field="object_id"></event> <value>0</value> </leaf> <not> <leaf> <comparator name="like_i_sql_unicode_string" package="sqlserver"></comparator> <event name="object_deleted" package="sqlserver" field="object_name"></event> <value><![CDATA[#%]]></value> </leaf> </not> </and> </or> </predicate> </event> <event package="sqlserver" name="sort_warning"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="client_pid" /> <action package="sqlserver" name="database_id" /> <action package="sqlserver" name="database_name" /> <action package="package0" name="event_sequence" /> <action package="sqlserver" name="username" /> <action package="sqlserver" name="request_id" /> <action package="sqlserver" name="session_id" /> <action package="sqlserver" name="transaction_id" /> </event> </event_session> </event_sessions> |