Re: SQL Server AUDIT component of SQL Server 2008 EE or SQL Server 2012 EE
1) Has anyone been able to produce a test harness (ie. T-SQL) that maps what DDL statements trigger what Audit Events? Eg. DROP TABLE [table-name] triggers the DATABASE_CHANGE_GROUP event.
Yes, this test harness would be quite large but very well worth putting together as a reference. I presently don't have the time to do this, and I can't see any easy/quick way of 'reverse-engineering' this info from the .sqlaudit logfile (although there must be a way as I can see a commercial product called 'LOGbinder SQL' doing something similar - see http://www.logbinder.com/products/LOGbinderSQL/default.aspx).
2) Has anyone worked out how to parse the .sqlaudit logfile with respect to my point 1 above? I suspect there must be a way of joining tables (.sqlaudit and others like sys.dm_audit_class_type), using action_id and class_type etc from .sqlaudit, to produce more specific information (ala LOGbinder).
Cheers, Mark
