Log All SA events

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Kev - 28 Mar 2007 15:50 GMT

Hello,
I have a person in my IT dept. that I suspect is using the SA account for a
SQL server that holds employee information(salary, etc.) that she should not
be accessing it. Is there a way that I can track where the Actual SA account
is coming from by IP address or machine name? I know I could change the SA
password, but we are not at a stage right now to do this.
Please advise?

Kev

Reply to this Message

Hari Prasad - 29 Mar 2007 03:08 GMT

Hello,

SQL 2000:-

Query the MASTER..SYSPROCESSES and log it into a table frequently and look
into the hostname column.

SQL 2005

Query the system view sys.sysprocesses and log it into a table frequently
and look into the hostname column.

Thanks
Hari

> Hello,
> I have a person in my IT dept. that I suspect is using the SA account for
[quoted text clipped - 8 lines]
>
> Kev

Reply to this Message

Sue Hoegemeier - 29 Mar 2007 12:57 GMT

What version of SQL Server? It really depends on what
version of SQL Server. At the very least on any version, you
could use a trace, filter on the Login Name sa and make sure
to capture the Host name. You may pick up the host computer
where the sa login is being used.

-Sue

>Hello,
>I have a person in my IT dept. that I suspect is using the SA account for a
[quoted text clipped - 5 lines]
>
>Kev

Reply to this Message

Kev - 29 Mar 2007 13:40 GMT

It is SQL 2000. I have done some tracing and found the host name column and
found what I was looking for. Thanks for your response!

> What version of SQL Server? It really depends on what
> version of SQL Server. At the very least on any version, you
[quoted text clipped - 13 lines]
> >
> >Kev

Reply to this Message