Sunday, April 15, 2007

Auditing Database Objects Drop/Create Using Default Trace.

First find out the Default Trace File for your server.
SELECT * FROM ::fn_trace_getinfo(0)

Then Query the Trace File
SELECT  
 loginname, 
 loginsid, 
 spid, 
 hostname, 
 applicationname, 
 servername, 
 databasename, 
 objectName, 
 e.category_id, 
 cat.name , 
 textdata, 
 starttime, 
 eventclass, 
 eventsubclass,
 e.name as EventName
FROM ::fn_trace_gettable('G:\SQLLog\LOG\log_115.trc',0)     /* Give your trace file here */
INNER JOIN sys.trace_events e      
ON eventclass = trace_event_id 
INNER JOIN sys.trace_categories AS cat      
ON e.category_id = cat.category_id
WHERE databasename = 'master' AND
 --objectname IS NULL AND /* filter by objectname if needed */
 e.category_id = 5 AND /* 5 is objects     */

 e.trace_event_id = 47  /* 46=Create Obj,47=Drop Obj,164=Alter Obj */