--先确定是否开启了默认跟踪
exec sp_configure 'show advanced options',1
reconfigure
exec sp_configure 'default trace enabled'
-- 查看事件类型描述,确定事件id(trace_event_id)
SELECT tc.name,te.trace_event_id,te.name,tc.type
,CASE tc.type WHEN 0 THEN '普通' WHEN 1 THEN '连接' WHEN 2 THEN '错误' END AS [type]
FROM sys.trace_categories tc
INNER JOIN sys.trace_events te on te.category_id = tc.category_id
ORDER BY tc.name,trace_event_id
sys.trace_events 目录视图包含所有 SQL 跟踪事件的列表,可以自行选择查看所需信息。
如 我要查看谁对对象进行了ddl操作。
-- 查看跟踪记录,根据事件id(trace_event_id)
DECLARE @path NVARCHAR(1000)
SELECT @path = Substring(PATH, 1, Len(PATH) - Charindex('\', Reverse(PATH))) +'\log.trc'
FROM sys.traces WHERE id = 1
SELECT DatabaseID,NTDomainName,NTUserName,HostName, ClientProcessID,ApplicationName
,LoginName,StartTime,DatabaseName,ObjectName,EventClass,SessionLoginName
FROM ::fn_trace_gettable(@path, 0)
WHERE EventClass in(46,47,164) and DatabaseName<>'tempdb' and ObjectName is not null
sys.traces: https://msdn.microsoft.com/zh-cn/library/ms178579.aspx