Windows Security Log Events



(LOGbinder for SharePoint)
(LOGbinder for SQL Server)
(LOGbinder for Exchange)
(MS Sysinternals Sysmon)
SQL Server Audit Action Group:

Action Group All

SQL Server 24000 SQL audit event
SQL Server 24001 Login succeeded (action_id LGIS)
SQL Server 24002 Logout succeeded (action_id LGO)
SQL Server 24003 Login failed (action_id LGIF)
SQL Server 24004 Change own password succeeded (action_id PWCS; class_type LX)
SQL Server 24005 Change own password failed (action_id PWCS; class_type LX)
SQL Server 24006 Change password succeeded (action_id PWC class_type LX)
SQL Server 24007 Change password failed (action_id PWC class_type LX)
SQL Server 24008 Reset own password succeeded (action_id PWRS; class_type LX)
SQL Server 24009 Reset own password failed (action_id PWRS; class_type LX)
SQL Server 24010 Reset password succeeded (action_id PWR; class_type LX)
SQL Server 24011 Reset password failed (action_id PWR; class_type LX)
SQL Server 24012 Must change password (action_id PWMC)
SQL Server 24013 Account unlocked (action_id PWU)
SQL Server 24014 Change application role password succeeded (action_id PWC; class_type AR)
SQL Server 24015 Change application role password failed (action_id PWC class_type AR)
SQL Server 24016 Add member to server role succeeded (action_id APRL class_type SG)
SQL Server 24017 Add member to server role failed (action_id APRL class_type SG)
SQL Server 24018 Remove member from server role succeeded (action_id DPRL class_type SG)
SQL Server 24019 Remove member from server role failed (action_id DPRL class_type SG)
SQL Server 24020 Add member to database role succeeded (action_id APRL class_type RL)
SQL Server 24021 Add member to database role failed (action_id APRL class_type RL)
SQL Server 24022 Remove member from database role succeeded (action_id DPRL class_type RL)
SQL Server 24023 Remove member from database role failed (action_id DPRL class_type RL)
SQL Server 24024 Issued database backup command (action_id BA class_type DB)
SQL Server 24025 Issued transaction log backup command (action_id BAL)
SQL Server 24026 Issued database restore command (action_id RS class_type DB)
SQL Server 24027 Issued transaction log restore command (action_id RS class_type DB)
SQL Server 24028 Issued database console command (action_id DBCC)
SQL Server 24029 Issued a bulk administration command (action_id ADBO)
SQL Server 24030 Issued an alter connection command (action_id ALCN)
SQL Server 24031 Issued an alter resources command (action_id ALRS)
SQL Server 24032 Issued an alter server state command (action_id ALSS)
SQL Server 24033 Issued an alter server settings command (action_id ALST)
SQL Server 24034 Issued a view server state command (action_id VSST)
SQL Server 24035 Issued an external access assembly command (action_id XA)
SQL Server 24036 Issued an unsafe assembly command (action_id XU)
SQL Server 24037 Issued an alter resource governor command (action_id ALRS class_type RG)
SQL Server 24038 Issued a database authenticate command (action_id AUTH)
SQL Server 24039 Issued a database checkpoint command (action_id CP)
SQL Server 24040 Issued a database show plan command (action_id SPLN)
SQL Server 24041 Issued a subscribe to query information command (action_id SUQN)
SQL Server 24042 Issued a view database state command (action_id VDST)
SQL Server 24043 Issued a change server audit command (action_id AL class_type A)
SQL Server 24044 Issued a change server audit specification command (action_id AL class_type SA)
SQL Server 24045 Issued a change database audit specification command (action_id AL class_type DA)
SQL Server 24046 Issued a create server audit command (action_id CR class_type A)
SQL Server 24047 Issued a create server audit specification command (action_id CR class_type SA)
SQL Server 24048 Issued a create database audit specification command (action_id CR class_type DA)
SQL Server 24049 Issued a delete server audit command (action_id DR class_type A)
SQL Server 24050 Issued a delete server audit specification command (action_id DR class_type SA)
SQL Server 24051 Issued a delete database audit specification command (action_id DR class_type DA)
SQL Server 24052 Audit failure (action_id AUSF)
SQL Server 24053 Audit session changed (action_id AUSC)
SQL Server 24054 Started SQL server (action_id SVSR)
SQL Server 24055 Paused SQL server (action_id SVPD)
SQL Server 24056 Resumed SQL server (action_id SVCN)
SQL Server 24057 Stopped SQL server (action_id SVSD)
SQL Server 24058 Issued a create server object command (action_id CR; class_type AG, EP, SD, SE, T)
SQL Server 24059 Issued a change server object command (action_id AL; class_type AG, EP, SD, SE, T)
SQL Server 24060 Issued a delete server object command (action_id DR; class_type AG, EP, SD, SE, T)
SQL Server 24061 Issued a create server setting command (action_id CR class_type SR)
SQL Server 24062 Issued a change server setting command (action_id AL class_type SR)
SQL Server 24063 Issued a delete server setting command (action_id DR class_type SR)
SQL Server 24064 Issued a create server cryptographic provider command (action_id CR class_type CP)
SQL Server 24065 Issued a delete server cryptographic provider command (action_id DR class_type CP)
SQL Server 24066 Issued a change server cryptographic provider command (action_id AL class_type CP)
SQL Server 24067 Issued a create server credential command (action_id CR class_type CD)
SQL Server 24068 Issued a delete server credential command (action_id DR class_type CD)
SQL Server 24069 Issued a change server credential command (action_id AL class_type CD)
SQL Server 24070 Issued a change server master key command (action_id AL class_type MK)
SQL Server 24071 Issued a back up server master key command (action_id BA class_type MK)
SQL Server 24072 Issued a restore server master key command (action_id RS class_type MK)
SQL Server 24073 Issued a map server credential to login command (action_id CMLG)
SQL Server 24074 Issued a remove map between server credential and login command (action_id NMLG)
SQL Server 24075 Issued a create server principal command (action_id CR class_type LX, SL)
SQL Server 24076 Issued a delete server principal command (action_id DR class_type LX, SL)
SQL Server 24077 Issued a change server principal credentials command (action_id CCLG)
SQL Server 24078 Issued a disable server principal command (action_id LGDA)
SQL Server 24079 Issued a change server principal default database command (action_id LGDB)
SQL Server 24080 Issued an enable server principal command (action_id LGEA)
SQL Server 24081 Issued a change server principal default language command (action_id LGLG)
SQL Server 24082 Issued a change server principal password expiration command (action_id PWEX)
SQL Server 24083 Issued a change server principal password policy command (action_id PWPL)
SQL Server 24084 Issued a change server principal name command (action_id LGNM)
SQL Server 24085 Issued a create database command (action_id CR class_type DB)
SQL Server 24086 Issued a change database command (action_id AL class_type DB)
SQL Server 24087 Issued a delete database command (action_id DR class_type DB)
SQL Server 24088 Issued a create certificate command (action_id CR class_type CR)
SQL Server 24089 Issued a change certificate command (action_id AL class_type CR)
SQL Server 24090 Issued a delete certificate command (action_id DR class_type CR)
SQL Server 24091 Issued a back up certificate command (action_id BA class_type CR)
SQL Server 24092 Issued an access certificate command (action_id AS class_type CR)
SQL Server 24093 Issued a create asymmetric key command (action_id CR class_type AK)
SQL Server 24094 Issued a change asymmetric key command (action_id AL class_type AK)
SQL Server 24095 Issued a delete asymmetric key command (action_id DR class_type AK)
SQL Server 24096 Issued an access asymmetric key command (action_id AS class_type AK)
SQL Server 24097 Issued a create database master key command (action_id CR class_type MK)
SQL Server 24098 Issued a change database master key command (action_id AL class_type MK)
SQL Server 24099 Issued a delete database master key command (action_id DR class_type MK)
SQL Server 24100 Issued a back up database master key command (action_id BA class_type MK)
SQL Server 24101 Issued a restore database master key command (action_id RS class_type MK)
SQL Server 24102 Issued an open database master key command (action_id OP class_type MK)
SQL Server 24103 Issued a create database symmetric key command (action_id CR class_type SK)
SQL Server 24104 Issued a change database symmetric key command (action_id AL class_type SK)
SQL Server 24105 Issued a delete database symmetric key command (action_id DR class_type SK)
SQL Server 24106 Issued a back up database symmetric key command (action_id BA class_type SK)
SQL Server 24107 Issued an open database symmetric key command (action_id OP class_type SK)
SQL Server 24108 Issued a create database object command (action_id CR)
SQL Server 24109 Issued a change database object command (action_id AL)
SQL Server 24110 Issued a delete database object command (action_id DR)
SQL Server 24111 Issued an access database object command (action_id AS)
SQL Server 24112 Issued a create assembly command (action_id CR class_type AS)
SQL Server 24113 Issued a change assembly command (action_id AL class_type AS)
SQL Server 24114 Issued a delete assembly command (action_id DR class_type AS)
SQL Server 24115 Issued a create schema command (action_id CR class_type SC)
SQL Server 24116 Issued a change schema command (action_id AL class_type SC)
SQL Server 24117 Issued a delete schema command (action_id DR class_type SC)
SQL Server 24118 Issued a create database encryption key command (action_id CR class_type DK)
SQL Server 24119 Issued a change database encryption key command (action_id AL class_type DK)
SQL Server 24120 Issued a delete database encryption key command (action_id DR class_type DK)
SQL Server 24121 Issued a create database user command (action_id CR; class_type US)
SQL Server 24122 Issued a change database user command (action_id AL; class_type US)
SQL Server 24123 Issued a delete database user command (action_id DR; class_type US)
SQL Server 24124 Issued a create database role command (action_id CR class_type RL)
SQL Server 24125 Issued a change database role command (action_id AL class_type RL)
SQL Server 24126 Issued a delete database role command (action_id DR class_type RL)
SQL Server 24127 Issued a create application role command (action_id CR class_type AR)
SQL Server 24128 Issued a change application role command (action_id AL class_type AR)
SQL Server 24129 Issued a delete application role command (action_id DR class_type AR)
SQL Server 24130 Issued a change database user login command (action_id USAF)
SQL Server 24131 Issued an auto-change database user login command (action_id USLG)
SQL Server 24132 Issued a create schema object command (action_id CR class_type D)
SQL Server 24133 Issued a change schema object command (action_id AL class_type D)
SQL Server 24134 Issued a delete schema object command (action_id DR class_type D)
SQL Server 24135 Issued a transfer schema object command (action_id TRO class_type D)
SQL Server 24136 Issued a create schema type command (action_id CR class_type TY)
SQL Server 24137 Issued a change schema type command (action_id AL class_type TY)
SQL Server 24138 Issued a delete schema type command (action_id DR class_type TY)
SQL Server 24139 Issued a transfer schema type command (action_id TRO class_type TY)
SQL Server 24140 Issued a create XML schema collection command (action_id CR class_type SX)
SQL Server 24141 Issued a change XML schema collection command (action_id AL class_type SX)
SQL Server 24142 Issued a delete XML schema collection command (action_id DR class_type SX)
SQL Server 24143 Issued a transfer XML schema collection command (action_id TRO class_type SX)
SQL Server 24144 Issued an impersonate within server scope command (action_id IMP; class_type LX)
SQL Server 24145 Issued an impersonate within database scope command (action_id IMP; class_type US)
SQL Server 24146 Issued a change server object owner command (action_id TO class_type SG)
SQL Server 24147 Issued a change database owner command (action_id TO class_type DB)
SQL Server 24148 Issued a change schema owner command (action_id TO class_type SC)
SQL Server 24150 Issued a change role owner command (action_id TO class_type RL)
SQL Server 24151 Issued a change database object owner command (action_id TO)
SQL Server 24152 Issued a change symmetric key owner command (action_id TO class_type SK)
SQL Server 24153 Issued a change certificate owner command (action_id TO class_type CR)
SQL Server 24154 Issued a change asymmetric key owner command (action_id TO class_type AK)
SQL Server 24155 Issued a change schema object owner command (action_id TO class_type OB)
SQL Server 24156 Issued a change schema type owner command (action_id TO class_type TY)
SQL Server 24157 Issued a change XML schema collection owner command (action_id TO class_type SX)
SQL Server 24158 Grant server permissions succeeded (action_id G class_type SR)
SQL Server 24159 Grant server permissions failed (action_id G class_type SR)
SQL Server 24160 Grant server permissions with grant succeeded (action_id GWG class_type SR)
SQL Server 24161 Grant server permissions with grant failed (action_id GWG class_type SR)
SQL Server 24162 Deny server permissions succeeded (action_id D class_type SR)
SQL Server 24163 Deny server permissions failed (action_id D class_type SR)
SQL Server 24164 Deny server permissions with cascade succeeded (action_id DWC class_type SR)
SQL Server 24165 Deny server permissions with cascade failed (action_id DWC class_type SR)
SQL Server 24166 Revoke server permissions succeeded (action_id R class_type SR)
SQL Server 24167 Revoke server permissions failed (action_id R class_type SR)
SQL Server 24168 Revoke server permissions with grant succeeded (action_id RWG class_type SR)
SQL Server 24169 Revoke server permissions with grant failed (action_id RWG class_type SR)
SQL Server 24170 Revoke server permissions with cascade succeeded (action_id RWC class_type SR)
SQL Server 24171 Revoke server permissions with cascade failed (action_id RWC class_type SR)
SQL Server 24172 Issued grant server object permissions command (action_id G; class_type LX)
SQL Server 24173 Issued grant server object permissions with grant command (action_id GWG; class_type LX)
SQL Server 24174 Issued deny server object permissions command (action_id D; class_type LX)
SQL Server 24175 Issued deny server object permissions with cascade command (action_id DWC; class_type LX)
SQL Server 24176 Issued revoke server object permissions command (action_id R; class_type LX)
SQL Server 24177 Issued revoke server object permissions with grant command (action_id; RWG class_type LX)
SQL Server 24178 Issued revoke server object permissions with cascade command (action_id RWC; class_type LX)
SQL Server 24179 Grant database permissions succeeded (action_id G class_type DB)
SQL Server 24180 Grant database permissions failed (action_id G class_type DB)
SQL Server 24181 Grant database permissions with grant succeeded (action_id GWG class_type DB)
SQL Server 24182 Grant database permissions with grant failed (action_id GWG class_type DB)
SQL Server 24183 Deny database permissions succeeded (action_id D class_type DB)
SQL Server 24184 Deny database permissions failed (action_id D class_type DB)
SQL Server 24185 Deny database permissions with cascade succeeded (action_id DWC class_type DB)
SQL Server 24186 Deny database permissions with cascade failed (action_id DWC class_type DB)
SQL Server 24187 Revoke database permissions succeeded (action_id R class_type DB)
SQL Server 24188 Revoke database permissions failed (action_id R class_type DB)
SQL Server 24189 Revoke database permissions with grant succeeded (action_id RWG class_type DB)
SQL Server 24190 Revoke database permissions with grant failed (action_id RWG class_type DB)
SQL Server 24191 Revoke database permissions with cascade succeeded (action_id RWC class_type DB)
SQL Server 24192 Revoke database permissions with cascade failed (action_id RWC class_type DB)
SQL Server 24193 Issued grant database object permissions command (action_id G class_type US)
SQL Server 24194 Issued grant database object permissions with grant command (action_id GWG; class_type US)
SQL Server 24195 Issued deny database object permissions command (action_id D; class_type US)
SQL Server 24196 Issued deny database object permissions with cascade command (action_id DWC; class_type US)
SQL Server 24197 Issued revoke database object permissions command (action_id R; class_type US)
SQL Server 24198 Issued revoke database object permissions with grant command (action_id RWG; class_type US)
SQL Server 24199 Issued revoke database object permissions with cascade command (action_id RWC; class_type US)
SQL Server 24200 Issued grant schema permissions command (action_id G class_type SC)
SQL Server 24201 Issued grant schema permissions with grant command (action_id GWG class_type SC)
SQL Server 24202 Issued deny schema permissions command (action_id D class_type SC)
SQL Server 24203 Issued deny schema permissions with cascade command (action_id DWC class_type SC)
SQL Server 24204 Issued revoke schema permissions command (action_id R class_type SC)
SQL Server 24205 Issued revoke schema permissions with grant command (action_id RWG class_type SC)
SQL Server 24206 Issued revoke schema permissions with cascade command (action_id RWC class_type SC)
SQL Server 24207 Issued grant assembly permissions command (action_id G class_type AS)
SQL Server 24208 Issued grant assembly permissions with grant command (action_id GWG class_type AS)
SQL Server 24209 Issued deny assembly permissions command (action_id D class_type AS)
SQL Server 24210 Issued deny assembly permissions with cascade command (action_id DWC class_type AS)
SQL Server 24211 Issued revoke assembly permissions command (action_id R class_type AS)
SQL Server 24212 Issued revoke assembly permissions with grant command (action_id RWG class_type AS)
SQL Server 24213 Issued revoke assembly permissions with cascade command (action_id RWC class_type AS)
SQL Server 24214 Issued grant database role permissions command (action_id G class_type RL)
SQL Server 24215 Issued grant database role permissions with grant command (action_id GWG class_type RL)
SQL Server 24216 Issued deny database role permissions command (action_id D class_type RL)
SQL Server 24217 Issued deny database role permissions with cascade command (action_id DWC class_type RL)
SQL Server 24218 Issued revoke database role permissions command (action_id R class_type RL)
SQL Server 24219 Issued revoke database role permissions with grant command (action_id RWG class_type RL)
SQL Server 24220 Issued revoke database role permissions with cascade command (action_id RWC class_type RL)
SQL Server 24221 Issued grant application role permissions command (action_id G class_type AR)
SQL Server 24222 Issued grant application role permissions with grant command (action_id GWG class_type AR)
SQL Server 24223 Issued deny application role permissions command (action_id D class_type AR)
SQL Server 24224 Issued deny application role permissions with cascade command (action_id DWC class_type AR)
SQL Server 24225 Issued revoke application role permissions command (action_id R class_type AR)
SQL Server 24226 Issued revoke application role permissions with grant command (action_id RWG class_type AR)
SQL Server 24227 Issued revoke application role permissions with cascade command (action_id RWC class_type AR)
SQL Server 24228 Issued grant symmetric key permissions command (action_id G class_type SK)
SQL Server 24229 Issued grant symmetric key permissions with grant command (action_id GWG class_type SK)
SQL Server 24230 Issued deny symmetric key permissions command (action_id D class_type SK)
SQL Server 24231 Issued deny symmetric key permissions with cascade command (action_id DWC class_type SK)
SQL Server 24232 Issued revoke symmetric key permissions command (action_id R class_type SK)
SQL Server 24233 Issued revoke symmetric key permissions with grant command (action_id RWG class_type SK)
SQL Server 24234 Issued revoke symmetric key permissions with cascade command (action_id RWC class_type SK)
SQL Server 24235 Issued grant certificate permissions command (action_id G class_type CR)
SQL Server 24236 Issued grant certificate permissions with grant command (action_id GWG class_type CR)
SQL Server 24237 Issued deny certificate permissions command (action_id D class_type CR)
SQL Server 24238 Issued deny certificate permissions with cascade command (action_id DWC class_type CR)
SQL Server 24239 Issued revoke certificate permissions command (action_id R class_type CR)
SQL Server 24240 Issued revoke certificate permissions with grant command (action_id RWG class_type CR)
SQL Server 24241 Issued revoke certificate permissions with cascade command (action_id RWC class_type CR)
SQL Server 24242 Issued grant asymmetric key permissions command (action_id G class_type AK)
SQL Server 24243 Issued grant asymmetric key permissions with grant command (action_id GWG class_type AK)
SQL Server 24244 Issued deny asymmetric key permissions command (action_id D class_type AK)
SQL Server 24245 Issued deny asymmetric key permissions with cascade command (action_id DWC class_type AK)
SQL Server 24246 Issued revoke asymmetric key permissions command (action_id R class_type AK)
SQL Server 24247 Issued revoke asymmetric key permissions with grant command (action_id RWG class_type AK)
SQL Server 24248 Issued revoke asymmetric key permissions with cascade command (action_id RWC class_type AK)
SQL Server 24249 Issued grant schema object permissions command (action_id G class_type OB)
SQL Server 24250 Issued grant schema object permissions with grant command (action_id GWG class_type OB)
SQL Server 24251 Issued deny schema object permissions command (action_id D class_type OB)
SQL Server 24252 Issued deny schema object permissions with cascade command (action_id DWC class_type OB)
SQL Server 24253 Issued revoke schema object permissions command (action_id R class_type OB)
SQL Server 24254 Issued revoke schema object permissions with grant command (action_id RWG class_type OB)
SQL Server 24255 Issued revoke schema object permissions with cascade command (action_id RWC class_type OB)
SQL Server 24256 Issued grant schema type permissions command (action_id G class_type TY)
SQL Server 24257 Issued grant schema type permissions with grant command (action_id GWG class_type TY)
SQL Server 24258 Issued deny schema type permissions command (action_id D class_type TY)
SQL Server 24259 Issued deny schema type permissions with cascade command (action_id DWC class_type TY)
SQL Server 24260 Issued revoke schema type permissions command (action_id R class_type TY)
SQL Server 24261 Issued revoke schema type permissions with grant command (action_id RWG class_type TY)
SQL Server 24262 Issued revoke schema type permissions with cascade command (action_id RWC class_type TY)
SQL Server 24263 Issued grant XML schema collection permissions command (action_id G class_type SX)
SQL Server 24264 Issued grant XML schema collection permissions with grant command (action_id GWG class_type SX)
SQL Server 24265 Issued deny XML schema collection permissions command (action_id D class_type SX)
SQL Server 24266 Issued deny XML schema collection permissions with cascade command (action_id DWC class_type SX)
SQL Server 24267 Issued revoke XML schema collection permissions command (action_id R class_type SX)
SQL Server 24268 Issued revoke XML schema collection permissions with grant command (action_id RWG class_type SX)
SQL Server 24269 Issued revoke XML schema collection permissions with cascade command (action_id RWC class_type SX)
SQL Server 24270 Issued reference database object permissions command (action_id RF)
SQL Server 24271 Issued send service request command (action_id SN)
SQL Server 24272 Issued check permissions with schema command (action_id VWCT)
SQL Server 24273 Issued use service broker transport security command (action_id LGB)
SQL Server 24274 Issued use database mirroring transport security command (action_id LGM)
SQL Server 24275 Issued alter trace command (action_id ALTR)
SQL Server 24276 Issued start trace command (action_id TASA)
SQL Server 24277 Issued stop trace command (action_id TASP)
SQL Server 24278 Issued enable trace C2 audit mode command (action_id C2ON)
SQL Server 24279 Issued disable trace C2 audit mode command (action_id C2OF)
SQL Server 24280 Issued server full-text command (action_id FT)
SQL Server 24281 Issued select command (action_id SL)
SQL Server 24282 Issued update command (action_id UP)
SQL Server 24283 Issued insert command (action_id IN)
SQL Server 24284 Issued delete command (action_id DL)
SQL Server 24285 Issued execute command (action_id EX)
SQL Server 24286 Issued receive command (action_id RC)
SQL Server 24287 Issued check references command (action_id RF)
SQL Server 24288 Issued a create user-defined server role command (action_id CR class_type SG)
SQL Server 24289 Issued a change user-defined server role command (action_id AL class_type SG)
SQL Server 24290 Issued a delete user-defined server role command (action_id DR class_type SG)
SQL Server 24291 Issued grant user-defined server role permissions command (action_id G class_type SG)
SQL Server 24292 Issued grant user-defined server role permissions with grant command (action_id GWG class_type SG)
SQL Server 24293 Issued deny user-defined server role permissions command (action_id D class_type SG)
SQL Server 24294 Issued deny user-defined server role permissions with cascade command (action_id DWC class_type SG)
SQL Server 24295 Issued revoke user-defined server role permissions command (action_id R class_type SG)
SQL Server 24296 Issued revoke user-defined server role permissions with grant command (action_id RWG class_type SG)
SQL Server 24297 Issued revoke user-defined server role permissions with cascade command (action_id RWC class_type SG)
SQL Server 24298 Database login succeeded (action_id DBAS)
SQL Server 24299 Database login failed (action_id DBAF)
SQL Server 24300 Database logout successful (action_id DAGL)
SQL Server 24301 Change password succeeded (action_id PWC; class_type US)
SQL Server 24302 Change password failed (action_id PWC; class_type US)
SQL Server 24303 Change own password succeeded (action_id PWCS; class_type US)
SQL Server 24304 Change own password failed (action_id PWCS; class_type US)
SQL Server 24305 Reset own password succeeded (action_id PWRS; class_type US)
SQL Server 24306 Reset own password failed (action_id PWRS; class_type US)
SQL Server 24307 Reset password succeeded (action_id PWR; class_type US)
SQL Server 24308 Reset password failed (action_id PWR; class_type US)
SQL Server 24309 Copy password (action_id USTC)
SQL Server 24310 User-defined SQL audit event (action_id UDAU)
SQL Server 24311 Issued a change database audit command (action_id AL class_type DU)
SQL Server 24312 Issued a create database audit command (action_id CR class_type DU)
SQL Server 24313 Issued a delete database audit command (action_id DR class_type DU)
SQL Server 24314 Issued a begin transaction command (action_id TXBG)
SQL Server 24315 Issued a commit transaction command (action_id TXCM)
SQL Server 24316 Issued a rollback transaction command (action_id TXRB)
SQL Server 24317 Issued a create column master key command (action_id CR; class_type CM)
SQL Server 24318 Issued a delete column master key command (action_id DR; class_type CM)
SQL Server 24319 A column master key was viewed (action_id VW; class_type CM)
SQL Server 24320 Issued a create column encryption key command (action_id CR; class_type CK)
SQL Server 24321 Issued a change column encryption key command (action_id AL; class_type CK)
SQL Server 24322 Issued a delete column encryption key command (action_id DR; class_type CK)
SQL Server 24323 A column encryption key was viewed (action_id VW; class_type CK)
SQL Server 24324 Issued a create database credential command (action_id CR; class_type DC)
SQL Server 24325 Issued a change database credential command (action_id AL; class_type DC)
SQL Server 24326 Issued a delete database credential command (action_id DR; class_type DC)
SQL Server 24327 Issued a change database scoped configuration command (action_id AL; class_type DS)
SQL Server 24328 Issued a create external data source command (action_id CR; class_type ED)
SQL Server 24329 Issued a change external data source command (action_id AL; class_type ED)
SQL Server 24330 Issued a delete external data source command (action_id DR; class_type ED)
SQL Server 24331 Issued a create external file format command (action_id CR; class_type EF)
SQL Server 24332 Issued a delete external file format command (action_id DR; class_type EF)
SQL Server 24333 Issued a create external resource pool command (action_id CR; class_type ER)
SQL Server 24334 Issued a change external resource pool command (action_id AL; class_type ER)
SQL Server 24335 Issued a delete external resource pool command (action_id DR; class_type ER)
SQL Server 24337 Global transaction login (action_id LGG)
SQL Server 24338 Grant permissions on a database scoped credential succeeded (action_id G; class_type DC)
SQL Server 24339 Grant permissions on a database scoped credential failed (action_id G; class_type DC)
SQL Server 24340 Grant permissions on a database scoped credential with grant succeeded (action_id GWG; class_type DC)
SQL Server 24341 Grant permissions on a database scoped credential with grant failed (action_id GWG; class_type DC)
SQL Server 24342 Deny permissions on a database scoped credential succeeded (action_id D; class_type DC)
SQL Server 24343 Deny permissions on a database scoped credential failed (action_id D; class_type DC)
SQL Server 24344 Deny permissions on a database scoped credential with cascade succeeded (action_id DWC; class_type DC)
SQL Server 24345 Deny permissions on a database scoped credential with cascade failed (action_id DWC; class_type DC)
SQL Server 24346 Revoke permissions on a database scoped credential succeeded (action_id R; class_type DC)
SQL Server 24347 Revoke permissions on a database scoped credential failed (action_id R; class_type DC)
SQL Server 24348 Revoke permissions with cascade on a database scoped credential succeeded (action_id RWC; class_type DC)
SQL Server 24349 Issued a change assembly owner command (action_id TO class_type AS)
SQL Server 24350 Revoke permissions with cascade on a database scoped credential failed (action_id RWC; class_type DC)
SQL Server 24351 Revoke permissions with grant on a database scoped credential succeeded (action_id RWG; class_type DC)
SQL Server 24352 Revoke permissions with grant on a database scoped credential failed (action_id RWG; class_type DC)
SQL Server 24353 Issued a change database scoped credential owner command (action_id TO; class_type DC)
SQL Server 24354 Issued a create external library command (action_id CR; class_type EL)
SQL Server 24355 Issued a change external library command (action_id AL; class_type EL)
SQL Server 24356 Issued a drop external library command (action_id DR; class_type EL)
SQL Server 24357 Grant permissions on an external library succeeded (action_id G; class_type EL)
SQL Server 24358 Grant permissions on an external library failed (action_id G; class_type EL)
SQL Server 24359 Grant permissions on an external library with grant succeeded (action_id GWG; class_type EL)
SQL Server 24360 Grant permissions on an external library with grant failed (action_id GWG; class_type EL)
SQL Server 24361 Deny permissions on an external library succeeded (action_id D; class_type EL)
SQL Server 24362 Deny permissions on an external library failed (action_id D; class_type EL)
SQL Server 24363 Deny permissions on an external library with cascade succeeded (action_id DWC; class_type EL)
SQL Server 24364 Deny permissions on an external library with cascade failed (action_id DWC; class_type EL)
SQL Server 24365 Revoke permissions on an external library succeeded (action_id R; class_type EL)
SQL Server 24366 Revoke permissions on an external library failed (action_id R; class_type EL)
SQL Server 24367 Revoke permissions with cascade on an external library succeeded (action_id RWC; class_type EL)
SQL Server 24368 Revoke permissions with cascade on an external library failed (action_id RWC; class_type EL)
SQL Server 24369 Revoke permissions with grant on an external library succeeded (action_id RWG; class_type EL)
SQL Server 24370 Revoke permissions with grant on an external library failed (action_id RWG; class_type EL)
SQL Server 24371 Issued a create database scoped resource governor command (action_id CR; class_type DR)
SQL Server 24372 Issued a change database scoped resource governor command (action_id AL; class_type DR)
SQL Server 24373 Issued a drop database scoped resource governor command (action_id DR; class_type DR)
SQL Server 24374 Issued a database bulk administration command (action_id DABO; class_type DB)
SQL Server 24375 Command to change permission failed (action_id D, DWC, G, GWG, R, RWC, RWG; class_type DC, EL)

 

Upcoming Webinars
    Additional Resources
      Encyclopedia
      Event IDs
      All Event IDs
      Audit Policy

      Go To Event ID:

      Security Log
      Quick Reference
      Chart
      Download now!