Skip Headers

Oracle® Audit Vault Auditor's Guide Release 10.2.3.1 Part Number E13842-02 |
Home | Book List | Contents | Index | Contact Us

Previous | Next
| View PDF

# B Microsoft SQL Server Audit Events

This appendix contains:

- About the Microsoft SQL Server Audit Events

- Account Management Events

- Application Management Events

- Audit Command Events

- Data Access Events

- Exception Events

- Invalid Record Events

- Object Management Events

- Peer Association Events

- Role and Privilege Management Events

- Service and Application Utilization Events

- System Management Events

- Unknown or Uncategorized Events

- User Session Events

## B.1 About the Microsoft SQL Server Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Microsoft SQL Server. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

- For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See "Creating an Alert" for more information.

- For custom reports using third-party tools. If you want to create custom reports using other Oracle Database reporting products or third-party tools, refer to the tables in this appendix when you design the reports. See Chapter 4, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with other tools.

## B.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as adding logins or changing login passwords. The Account Management Report, described in Section 3.4.1, uses these events.

Table B-1 lists the Microsoft SQL Server account management events and event IDs.

Table B-1 SQL Server Account Management Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit AddLogin Event` | `ADDLOGIN:ADD` `ADDLOGIN:DROP`
`Audit Database Principal Management Event` | `DATABASE PRINCIPAL MANAGEMENT:ALTER: USER` `DATABASE PRINCIPAL MANAGEMENT:CREATE: USER` `DATABASE PRINCIPAL MANAGEMENT:DROP: USER`
`Audit Login Change Password Event` | `LOGIN CHANGE PASSWORD:PASSWORD CHANGED` `LOGIN CHANGE PASSWORD:PASSWORD MUST CHANGE` `LOGIN CHANGE PASSWORD:PASSWORD RESET` `LOGIN CHANGE PASSWORD:PASSWORD SELF CHANGED` `LOGIN CHANGE PASSWORD:PASSWORD SELF RESET` `LOGIN CHANGE PASSWORD:PASSWORD UNLOCKED`
`Audit Login Change Property Event` | `LOGIN CHANGE PROPERTY:CREDENTIAL CHANGED` `LOGIN CHANGE PROPERTY:DEFAULT DATABASE` `LOGIN CHANGE PROPERTY:DEFAULT DATABASE CHANGED` `LOGIN CHANGE PROPERTY:DEFAULT LANGUAGE` `LOGIN CHANGE PROPERTY:DEFAULT LANGUAGE CHANGED` `LOGIN CHANGE PROPERTY:EXPIRATION CHANGED` `LOGIN CHANGE PROPERTY:NAME CHANGED` `LOGIN CHANGE PROPERTY:POLICY CHANGED`
`Audit Server Object Management Event` | `SERVER OBJECT MANAGEMENT:CREDENTIAL MAP DROPPED` `SERVER OBJECT MANAGEMENT:CREDENTIAL MAPPED TO LOGIN`
`Audit Server Principal Management Event` | `SERVER PRINCIPAL MANAGEMENT:ALTER: USER` `SERVER PRINCIPAL MANAGEMENT:CREATE: USER` `SERVER PRINCIPAL MANAGEMENT:DISABLE: USER` `SERVER PRINCIPAL MANAGEMENT:DROP: USER` `SERVER PRINCIPAL MANAGEMENT:ENABLE: USER`

Table B-2 lists the Microsoft SQL Server account management event attributes.

Table B-2 SQL Server Account Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.3 Application Management Events

Application management events track actions that were performed on the underlying SQL statements, such as creating objects. The Procedure Management Report, described in Section 3.4.4, uses these events.

Table B-3 lists the Microsoft SQL Server application management events and event IDs.

Table B-3 SQL Server Application Management Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit Database Object Take Ownership Event` | `DATABASE OBJECT TAKE OWNERSHIP: TRIGGER`
`Audit Schema Object Take Ownership Event` | `SCHEMA OBJECT TAKE OWNERSHIP: PROCEDURE` `SCHEMA OBJECT TAKE OWNERSHIP: TYPE` `SCHEMA OBJECT TAKE OWNERSHIP: TRIGGER`
`Audit Server Object Take Ownership Event` | `TRIGGER`
`Object:Created` | `OBJECT:CREATED:PROCEDURE` `OBJECT:CREATED:TRIGGER` `OBJECT:CREATED:TYPE`
`Object:Deleted` | `OBJECT:DELETED:PROCEDURE` `OBJECT:DELETED:TRIGGER`

Table B-4 lists the Microsoft SQL Server application management event attributes.

Table B-4 SQL Server Application Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_NAME` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`NEW_OBJECT_NAME` | `VARCHAR2(4000)`
`NEW_OBJECT_OWNER` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.4 Audit Command Events

Audit command events track the use of audit events, such as altering trace events. The Audit Command Report, described in Section 3.4.2, uses these events.

Table B-5 lists the Microsoft SQL Server audit command events and event IDs.

Table B-5 SQL Server Audit Command Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit Change Audit Event` | `CHANGE AUDIT:AUDIT STARTED` `CHANGE AUDIT:AUDIT STOPPED` `CHANGE AUDIT:C2 MODE OFF` `CHANGE AUDIT:C2 MODE ON` `CHANGE:AUDIT STOPPED` `CHANGE:NEW AUDIT STARTED`
`Audit Server Alter Trace Event` | `SERVER ALTER TRACE`
`ExistingConnection` | `EXISTINGCONNECTION`

Table B-6 lists the Microsoft SQL Server audit command events that are logged in the Windows Event Viewer.

Table B-6 SQL Server Audit Command Events Logged in Windows Event Viewer

Event ID:Subclass | Severity
--- | ---
`OP ALTER TRACE: START` | `10`
`OP ALTER TRACE: STOP` | `10`

Table B-7 lists the Microsoft SQL Server audit command event attributes.

Table B-7 SQL Server Audit Command Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`AUDIT_OPTION` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.5 Data Access Events

The data access event tracks SQL transactions. The Data Access Report, described in Section 3.3.2, uses these events.

Table B-8 shows the Microsoft SQL Server data access event and event ID.

Table B-8 SQL Server Data Access Event and Event ID

Event Name | Event ID:Subclass
--- | ---
`SQL Transaction` | `TRANSACTION:BEGIN`

Table B-9 lists the Microsoft SQL Server data access event attributes.

Table B-9 SQL Server Data Access Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.6 Exception Events

Exception events track audited error and exception activity, such as background job errors. The Exception Activity Report, described in Section 3.5.1, uses these events.

Table B-10 lists the Microsoft SQL Server exception events and event IDs.

Table B-10 SQL Server Exception Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Background Job Error` | `BACKGROUND JOB ERROR:ERROR RETURN` `BACKGROUND JOB ERROR:FAILURE` `BACKGROUND JOB ERROR:QUEUE IS FULL`
`Blocked Process Report` | `BLOCKED PROCESS REPORT`

Table B-11 lists the Microsoft SQL Server exception events that are logged in the Windows Event Viewer.

Table B-11 SQL Server Exception Events Logged in the Windows Event Viewer

Event ID:Subclass | Severity
--- | ---
`OP ERROR: COMMIT` | `10`
`OP ERROR: DB OFFLINE` | `10`
`OP ERROR: MIRRORING ERROR` | `16`
`OP ERROR: .NET FATAL ERROR` | `16`
`OP ERROR: .NET USER CODE` | `16`
`OP ERROR: PROCESS VIOLATION` | `16`
`OP ERROR: RECOVER` | `21`
`OP ERROR: RESTORE FAILED` | `21`
`OP ERROR: ROLLBACK` | `10`
`OP ERROR: SERVER SHUT DOWN` | `21`
`OP ERROR: STACK OVER FLOW` | `16`

Table B-12 lists the Microsoft SQL Server exception event attributes.

Table B-12 SQL Server Exception Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.7 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.5.2, uses the invalid record event attributes. (These events do not have any event names or event IDs; they only contain event attributes.)

Table B-13 lists the Microsoft SQL Server invalid record event attributes.

Table B-13 SQL Server Invalid Record Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`ERROR_ID` | `NUMBER`
`ERROR_MESSAGE` | `VARCHAR2(30)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`MODULE_NAME` | `VARCHAR2(100)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`ORIGINAL_CONTENT1` | `VARCHAR2(4000)`
`ORIGINAL_CONTENT2` | `VARCHAR2(4000)`
`ORIGINAL_CONTENT3` | `VARCHAR2(4000)`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SEVERITY` | `NUMBER`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.8 Object Management Events

Object management events track audited actions performed on database objects, such as altering an object. The Object Management Report, described in Section 3.4.3, uses these events.

Table B-14 lists the Microsoft SQL Server object management events and event IDs.

Table B-14 SQL Server Object Management Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit Database Object Access Event` | `DATABASE OBJECT ACCESS`
`Audit Database Object Management Event` | `DATABASE OBJECT MANAGEMENT:ACCESS`
`Audit Database Object Take Ownership Event` | `DATABASE OBJECT TAKE OWNERSHIP: OBJECT` `DATABASE OBJECT TAKE OWNERSHIP: SCHEMA`
`Audit Database Principal Management Event` | `DATABASE PRINCIPAL MANAGEMENT:ALTER: OBJECT` `DATABASE PRINCIPAL MANAGEMENT:CREATE: OBJECT` `DATABASE PRINCIPAL MANAGEMENT:DROP: OBJECT`
`Audit Schema Object Access Event` | `SCHEMA OBJECT ACCESS`
`Audit Schema Object Management Event` | `SCHEMA OBJECT MANAGEMENT:ALTER` `SCHEMA OBJECT MANAGEMENT:CREATE` `SCHEMA OBJECT MANAGEMENT:DROP` `SCHEMA OBJECT MANAGEMENT:TRANSFER`
`Audit Schema Object Take Ownership Event` | `SCHEMA OBJECT TAKE OWNERSHIP: INDEX` `SCHEMA OBJECT TAKE OWNERSHIP: OBJECT` `SCHEMA OBJECT TAKE OWNERSHIP: TABLE`
`Audit Server Object Take Ownership Event` | `SERVER OBJECT TAKE OWNERSHIP: OBJECT`
`Lock:Deadlock` | `LOCK:DEADLOCK`
`Lock:Deadlock Chain` | `LOCK:DEADLOCK CHAIN` `LOCK:DEADLOCK CHAIN:RESOURCE TYPE LOCK`
`Object:Altered` | `OBJECT:ALTERED` `OBJECT:ALTERED:COMMIT` `OBJECT:ALTERED:INDEX` `OBJECT:ALTERED:PROCEDURE` `OBJECT:ALTERED:ROLLBACK` `OBJECT:ALTERED:TABLE` `OBJECT:ALTERED:TRIGGER` `OBJECT:ALTERED:TYPE`
`Object:Closed` | `OBJECT:CLOSED`
`Object:Created` | `OBJECT:CREATED` `OBJECT:CREATED:COMMIT` `OBJECT:CREATED:INDEX` `OBJECT:CREATED:PROCEDURE` `OBJECT:CREATED:ROLLBACK` `OBJECT:CREATED:SCHEMA` `OBJECT:CREATED:SYNONYM` `OBJECT:CREATED:TABLE` `OBJECT:CREATED:TRIGGER` `OBJECT:CREATED:TYPE` `OBJECT:CREATED:VIEW`
`Object:Deleted` | `OBJECT:DELETED` `OBJECT:DELETED:COMMIT` `OBJECT:DELETED:INDEX` `OBJECT:DELETED:PROCEDURE` `OBJECT:DELETED:ROLLBACK` `OBJECT:DELETED:SYNONYM` `OBJECT:DELETED:TABLE` `OBJECT:DELETED:TRIGGER` `OBJECT:DELETED:TYPE` `OBJECT:DELETED:VIEW`

Table B-15 lists the Microsoft SQL Server object management event attributes.

Table B-15 SQL Server Object Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_NAME` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`NEW_OBJECT_NAME` | `VARCHAR2(4000)`
`NEW_OBJECT_OWNER` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.9 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.4, uses these events. (These events do not have any event names or event IDs; they only contain event attributes.)

Table B-16 lists the Microsoft SQL Server peer association event attributes.

Table B-16 SQL Server Peer Association Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.10 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting a user access permission. The Role and Privilege Management Report, described in Section 3.4.5, uses these events.

Table B-17 lists the Microsoft SQL Server role and privilege management events and event IDs.

Table B-17 SQL Server Role and Privilege Management Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit Add DB User Event` | `ADD DB USER:GRANT DATABASE ACCESS` `ADD DB USER:GRANTDBACCESS` `ADD DB USER:REVOKE DATABASE ACCESS` `ADD DB USER:REVOKEDBACCESS`
`Audit Add Login to Server Role Event` | `ADD LOGIN TO SERVER ROLE:ADD` `ADD LOGIN TO SERVER ROLE:DROP`
`Audit Add Member to DB Role Event` | `ADD MEMBER TO DB ROLE:ADD` `ADD MEMBER TO DB ROLE:CHANGE GROUP` `ADD MEMBER TO DB ROLE:DROP`
`Audit Add Role Event` | `ADD ROLE:ADD` `ADD ROLE:DROP`
`Audit App Role Change Password Event` | `APP ROLE CHANGE PASSWORD`
`Audit Database Object GDR Event` | `DATABASE OBJECT GDR:DENY` `DATABASE OBJECT GDR:GRANT` `DATABASE OBJECT GDR:REVOKE`
`Audit Database Principal Management Event` | `DATABASE PRINCIPAL MANAGEMENT:ALTER: ROLE` `DATABASE PRINCIPAL MANAGEMENT:CREATE: ROLE` `DATABASE PRINCIPAL MANAGEMENT:DROP: ROLE`
`Audit Login GDR Event` | `LOGIN GDR:DENY` `LOGIN GDR:GRANT` `LOGIN GDR:GRANT` `LOGIN GDR:REVOKE`
`Audit Object Derived Permission Event` | `OBJECT DERIVED PERMISSION:ALTER` `OBJECT DERIVED PERMISSION:CREATE` `OBJECT DERIVED PERMISSION:DROP` `OBJECT DERIVED PERMISSION:DUMP` `OBJECT DERIVED PERMISSION:LOAD`
`Audit Object GDR Event` | `OBJECT GDR:DENY` `OBJECT GDR:GRANT` `OBJECT GDR:REVOKE`
`Audit Object Permission Event` | `OBJECT PERMISSION`
`Audit Server Object GDR Event` | `SERVER OBJECT GDR:DENY` `SERVER OBJECT GDR:GRANT` `SERVER OBJECT GDR:REVOKE`
`Audit Server Scope GDR Event` | `SERVER SCOPE GDR:DENY` `SERVER SCOPE GDR:GRANT` `SERVER SCOPE GDR:REVOKE`
`Audit Statement GDR Event` | `STATEMENT GDR:DENY` `STATEMENT GDR:GRANT` `STATEMENT GDR:REVOKE`
`Audit Statement Permission Event` | `STATEMENT PERMISSION`

Table B-18 lists the Microsoft SQL Server role and privilege management event attributes.

Table B-18 SQL Server Role and Privilege Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`ADMIN_OPTION` | `NUMBER`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GRANTEE` | `VARCHAR2(4000)`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`ROLE_NAME` | `VARCHAR2(4000)`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`SYSTEM_PRIVILEGE` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.11 Service and Application Utilization Events

Service and application utilization events track audited application access activity. The Procedure Executions Report, described in Section 3.3.5, uses these events.

Table B-19 lists the Microsoft SQL Server service and application utilization events and event IDs.

Table B-19 SQL Server Service and Application Utilization Events and Event IDs

Event Name | Event ID
--- | ---
`Audit Broker Conversation` | `BROKER CONVERSATION:INVALID SIGNATURE` `BROKER CONVERSATION:NO CERTIFICATE` `BROKER CONVERSATION:NO SECURITY HEADER` `BROKER CONVERSATION:RUN AS TARGET FAILURE`
`Broker:Activation` | `BROKER:ACTIVATION:ABORTED`
`Broker:Queue Disabled` | `BROKER:QUEUE DISABLED`

Table B-20 lists the Microsoft SQL Server service and application utilization event attributes.

Table B-20 SQL Server Service and Application Utilization Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.12 System Management Events

System management events track audited system management activity, such as backup and restore operations. The System Management Report, described in Section 3.4.6, uses these events.

Table B-21 lists the Microsoft SQL Server system management events and event IDs.

Table B-21 SQL Server System Management Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit Add DB User Event` | `ADD DB USER:ADD` `ADD DB USER:DROP` `ADD DB USER:SP_ADDUSER` `ADD DB USER:SP_DROPUSER`
`Audit Backup/Restore Event` | `BACKUP/RESTORE:BACKUP` `BACKUP/RESTORE:BACKUPLOG` `BACKUP/RESTORE:RESTORE`
`Audit Change Database Owner` | `CHANGE DATABASE OWNER`
`Audit Database Management Event` | `DATABASE MANAGEMENT:ALTER` `DATABASE MANAGEMENT:CREATE` `DATABASE MANAGEMENT:DROP` `DATABASE MANAGEMENT:DUMP` `DATABASE MANAGEMENT:LOAD`
`Audit Database Object Management Event` | `DATABASE OBJECT MANAGEMENT:ALTER` `DATABASE OBJECT MANAGEMENT:CREATE` `DATABASE OBJECT MANAGEMENT:DROP` `DATABASE OBJECT MANAGEMENT:DUMP` `DATABASE OBJECT MANAGEMENT:LOAD` `DATABASE OBJECT MANAGEMENT:OPEN`
`Audit Database Operation Event` | `DATABASE OPERATION:SUBSCRIBE TO QUERY NOTIFICATION`
`Audit Database Principal Management Event` | `DATABASE PRINCIPAL MANAGEMENT:DUMP` `DATABASE PRINCIPAL MANAGEMENT:LOAD`
`Audit DBCC Event` | `DB CONSISTENCY CHECK`
`Audit Schema Object Management Event` | `SCHEMA OBJECT MANAGEMENT:DUMP` `SCHEMA OBJECT MANAGEMENT:LOAD`
`Audit Server Object Management Event` | `SERVER OBJECT MANAGEMENT:ALTER` `SERVER OBJECT MANAGEMENT:CREATE` `SERVER OBJECT MANAGEMENT:DROP` `SERVER OBJECT MANAGEMENT:DUMP` `SERVER OBJECT MANAGEMENT:LOAD`
`Audit Server Operation Event` | `SERVER OPERATION:ADMINISTER BULK OPERATIONS` `SERVER OPERATION:ALTER RESOURCES` `SERVER OPERATION:ALTER SERVER STATE` `SERVER OPERATION:ALTER SETTINGS` `SERVER OPERATION:AUTHENTICATE` `SERVER OPERATION:EXTERNAL ACCESS`
`Audit Server Principal Management Event` | `SERVER PRINCIPAL MANAGEMENT:DUMP: USER` `SERVER PRINCIPAL MANAGEMENT:LOAD: USER`
`Audit Server Starts and Stops` | `SERVER STARTS AND STOPS:SHUTDOWN` `SERVER STARTS AND STOPS:STARTED` `SERVER STARTS AND STOPS:PAUSED` `SERVER STARTS AND STOPS:CONTINUE`
`Audit Server Starts and Stops Event` | `SERVER STARTS AND STOPS:INSTANCE CONTINUED` `SERVER STARTS AND STOPS:INSTANCE PAUSE` `SERVER STARTS AND STOPS:INSTANCE SHUTDOWN` `SERVER STARTS AND STOPS:INSTANCE STARTED`
`Database Mirroring State Change` | `DATABASE MIRRORING STATE CHANGE`
`Mount Tape` | `MOUNT TAPE:TAPE MOUNT CANCELLED` `MOUNT TAPE:TAPE MOUNT COMPLETE` `MOUNT TAPE:TAPE MOUNT REQUEST`

Table B-22 lists the Microsoft SQL Server system management event attributes.

Table B-22 SQL Server System Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.13 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as user-created configurations. The Uncategorized Activity Report, described in Section 3.5.3, uses these events.

Table B-23 shows the Microsoft SQL Server unknown or uncategorized event and event ID.

Table B-23 SQL Server Unknown or Uncategorized Event and Event ID

Event Name | Event ID:Subclass
--- | ---
`User Configurable (0-9)` | `USER CONFIGURABLE`

Table B-24 lists the Microsoft SQL Server unknown or uncategorized event attributes.

Table B-24 SQL Server Unknown or Uncategorized Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`

## B.14 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.6, uses these events.

Table B-25 lists the Microsoft SQL Server user session events and event IDs.

Table B-25 SQL Server User Session Events and Event IDs

Event Name | Event ID:Subclass
--- | ---
`Audit Broker Login` | `BROKER LOGIN:AUTHENTICATION FAILURE` `BROKER LOGIN:LOGIN SUCCESS` `BROKER LOGIN:LOGIN PROTOCOL ERROR` `BROKER LOGIN:MESSAGE FORMAT ERROR` `BROKER LOGIN:NEGOTIATE FAILURE`
`Audit Database Operation Event` | `DATABASE OPERATION:CHECKPOINT`
`Audit Database Principal Impersonation Event` | `DATABASE PRINCIPAL IMPERSONATION`
`Audit Login` | `AUDIT LOGIN:LOGIN`
`Audit Login Event` | `AUDIT LOGIN EVENT:LOGIN`
`Audit Login Failed` | `AUDIT LOGIN FAILED:LOGIN FAILED`
`Audit Login Failed Event` | `AUDIT LOGIN FAILED EVENT:LOGIN FAILED`
`Audit Logout` | `AUDIT LOGOUT:LOGOUT`
`Audit Logout Event` | `AUDIT LOGOUT EVENT:LOGOUT`
`Audit Server Principal Impersonation Event` | `SERVER PRINCIPAL IMPERSONATION`
`SQL Transaction` | `SQL TRANSACTION:COMMIT` `SQL TRANSACTION:ROLLBACK` `SQL TRANSACTION:SAVEPOINT`

Table B-26 lists the Microsoft SQL Server user session event attributes.

Table B-26 SQL Server User Session Event Attributes

Attribute Name | Data Type
--- | ---
`ADDL_INFO` | `VARCHAR2(4000)`
`AUTHENTICATION_METHOD` | `VARCHAR2(255)`
`COLUMN_PERMISSIONS` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`CPU` | `NUMBER`
`DATABASE_ID` | `NUMBER`
`DATABASE_NAME` | `VARCHAR2(4000)`
`DBUSER_NAME` | `VARCHAR2(4000)`
`DURATION` | `NUMBER`
`END_TIME` | `TIMESTAMP`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_SEQUENCE` | `NUMBER`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_SUB_CLASS` | `NUMBER`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GUID` | `NUMBER`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INDEX_ID` | `NUMBER`
`IS_SYSTEM` | `NUMBER`
`LINKED_SERVER_NAME` | `VARCHAR2(4000)`
`LOGIN_SID` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OBJECT_ID2` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`OWNER_ID` | `NUMBER`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SERVER_NAME` | `VARCHAR2(4000)`
`SESSION_LOGIN_NAME` | `VARCHAR2(4000)`
`SOURCE_DATABASE_ID` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_LOGIN_NAME` | `VARCHAR2(4000)`
`TARGET_LOGIN_SID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OBJECT_TYPE` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`TEXT_DATA` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`USERNAME` | `VARCHAR2(4000)`