5&MSPPError=-2147217396
ALTER DATABASE AUDIT SPECIFICATION [Audit_Specification_Database]
WITH ( STATE = OFF )
GO
ALTER DATABASE AUDIT SPECIFICATION [Audit_Specification_Database]
FOR SERVER AUDIT [Audit_ToFile]
ADD ( UPDATE,INSERT,DELETE ON dbo.ErrorLog BY [dbo]),
DROP ( SELECT ON dbo.ErrorLog BY [dbo])
WITH ( STATE = ON )
GO
-- 删除数据库审核规范对象 (必须禁止审核收集此审核规范的记录)
-- https://msdn.microsoft.com/zh-cn/library/cc280479%28v=sql.100%29.aspx?f=255&MSPPError=-2147217396
ALTER DATABASE AUDIT SPECIFICATION [Audit_Specification_Database]
WITH ( STATE = OFF )
GO
IF EXISTS (SELECT * FROM sys.database_audit_specifications WHERE name = N'Audit_Specification_Database')
DROP DATABASE AUDIT SPECIFICATION [Audit_Specification_Database]
GO
?
?
?
-- 当删除数据库AdventureWorks2008R2的表ErrorLog时
delete from dbo.ErrorLog
-- 审核日志记录如下
?
-- 相关视图查询
select * from sys.server_audits --审核对象
select * from sys.dm_server_audit_status --审核的当前状态
select * from sys.server_audit_specifications --服务器审核规范对象
select * from sys.server_audit_specification_details --服务器审核规范对象的审核操作
select * from sys.database_audit_specifications --数据库审核规范对象
select * from sys.database_audit_specification_details --数据库审核规范对象的审核操作
select * from sys.dm_audit_actions --所有可用的操作组
select * from sys.dm_audit_class_type_map --审核日志中的字段映射
select * from sys.server_file_audits --审核文件信息
select * from sys.fn_get_audit_file('E:\Audit_ToFile_*.sqlaudit',default,default);