bin/XEtemplates/Login Tracker.xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
<event_sessions xmlns="http://schemas.microsoft.com/sqlserver/2008/07/extendedeventsconfig">
   <event_session name="Login Tracker" maxMemory="4" eventRetentionMode="allowSingleEventLoss" trackCausality="false" dispatchLatency="1" maxEventSize="0" memoryPartitionMode="none">
       <templateCategory>
      <!-- _locID_text="templateCategory" _locComment = "" -->System Monitoring</templateCategory>
    <templateName>
      <!-- _locID_text = "templateName" _locComment = "" -->Login Tracker</templateName>
    <templateDescription>
      <!-- _locID_text = "templateDescription" _locComment = "" -->Monitors logins to databases</templateDescription>
      <event package="sqlserver" name="sql_statement_starting">
         <action package="sqlserver" name="client_app_name" />
         <action package="sqlserver" name="client_hostname" />
         <action package="sqlserver" name="database_name" />
         <action package="sqlserver" name="server_instance_name" />
         <action package="sqlserver" name="server_principal_name" />
         <parameter name="collect_statement" value="0" />
         <predicate>
            <and>
               <and>
                  <and>
                     <leaf>
                        <comparator name="equal_boolean" package="package0" />
                        <global name="is_system" package="sqlserver" />
                        <value>false</value>
                     </leaf>
                     <not>
                        <leaf>
                           <comparator name="like_i_sql_unicode_string" package="sqlserver" />
                           <global name="client_app_name" package="sqlserver" />
                           <value><![CDATA[%dbatools%]]></value>
                        </leaf>
                     </not>
                  </and>
                  <not>
                     <leaf>
                        <comparator name="like_i_sql_unicode_string" package="sqlserver" />
                        <global name="client_app_name" package="sqlserver" />
                        <value><![CDATA[%management studio%]]></value>
                     </leaf>
                  </not>
               </and>
               <leaf>
                  <comparator name="not_equal_i_sql_unicode_string" package="sqlserver" />
                  <global name="database_name" package="sqlserver" />
                  <value><![CDATA[tempdb]]></value>
               </leaf>
            </and>
         </predicate>
      </event>
      <target package="package0" name="event_file">
         <parameter name="filename" value="Login Tracker" />
         <parameter name="max_file_size" value="10" />
      </target>
   </event_session>
</event_sessions>