HOW TO READ MSSQL TRACE?
GO
DECLARE @tracefile VARCHAR(500)
-- Get path of default trace file
SELECT @tracefile = CAST(value AS VARCHAR(500))
FROM ::fn_trace_getinfo(DEFAULT)
WHERE traceid = 1
AND property = 2
PRINT @tracefile
-- Get security changes from the default trace
SELECT *
FROM ::fn_trace_gettable(@tracefile, DEFAULT) trcdata -- DEFAULT means all trace files will be read
INNER JOIN sys.trace_events evt ON trcdata.EventClass = evt.trace_event_id
WHERE trcdata.EventClass IN (102, 103, 104, 105, 106, 108, 109, 110, 111)
ORDER BY trcdata.StartTime
Comments
Post a Comment