bin/XEtemplates/Login Tracker.xml
<event_sessions xmlns="http://schemas.microsoft.com/sqlserver/2008/07/extendedeventsconfig">
<event_session name="Login Tracker" maxMemory="4" eventRetentionMode="allowSingleEventLoss" trackCausality="false" dispatchLatency="1" maxEventSize="0" memoryPartitionMode="none"> <templateCategory> <!-- _locID_text="templateCategory" _locComment = "" -->System Monitoring</templateCategory> <templateName> <!-- _locID_text = "templateName" _locComment = "" -->Login Tracker</templateName> <templateDescription> <!-- _locID_text = "templateDescription" _locComment = "" -->Monitors logins to databases</templateDescription> <event package="sqlserver" name="sql_statement_starting"> <action package="sqlserver" name="client_app_name" /> <action package="sqlserver" name="client_hostname" /> <action package="sqlserver" name="database_name" /> <action package="sqlserver" name="server_instance_name" /> <action package="sqlserver" name="server_principal_name" /> <parameter name="collect_statement" value="0" /> <predicate> <and> <and> <and> <leaf> <comparator name="equal_boolean" package="package0" /> <global name="is_system" package="sqlserver" /> <value>false</value> </leaf> <not> <leaf> <comparator name="like_i_sql_unicode_string" package="sqlserver" /> <global name="client_app_name" package="sqlserver" /> <value><![CDATA[%dbatools%]]></value> </leaf> </not> </and> <not> <leaf> <comparator name="like_i_sql_unicode_string" package="sqlserver" /> <global name="client_app_name" package="sqlserver" /> <value><![CDATA[%management studio%]]></value> </leaf> </not> </and> <leaf> <comparator name="not_equal_i_sql_unicode_string" package="sqlserver" /> <global name="database_name" package="sqlserver" /> <value><![CDATA[tempdb]]></value> </leaf> </and> </predicate> </event> <target package="package0" name="event_file"> <parameter name="filename" value="Login Tracker" /> <parameter name="max_file_size" value="10" /> </target> </event_session> </event_sessions> |