HOW TO READ MSSQL TRACE?
GO DECLARE @tracefile VARCHAR(500) -- Get path of default trace file SELECT @tracefile = CAST(value AS VARCHAR(500)) FROM ::fn_trace_getinfo(DEFAULT) WHERE traceid = 1 AND property = 2 PRINT @tracefile -- Get security changes from the default trace SELECT * FROM ::fn_trace_gettable(@tracefile, DEFAULT) trcdata -- DEFAULT means all trace files will be read INNER JOIN sys.trace_events evt ON trcdata.EventClass = evt.trace_event_id WHERE trcdata.EventClass IN (102, 103, 104, 105, 106, 108, 109, 110, 111) ORDER BY trcdata.StartTime