Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 Transact-SQL (2005)
 using CASE with fn_trace_geteventinfo()

Author  Topic 

bulump
Starting Member

6 Posts

Posted - 2012-01-04 : 17:23:41

I'm trying to run a query that uses fn_trace_geteventinfo(), but I want to see if a certain event is being traced.

My query is:

SELECT distinct(e.name) AS Event_Name FROM fn_trace_geteventinfo(1) ei JOIN sys.trace_events e ON ei.eventid = e.trace_event_id JOIN sys.trace_columns c ON ei.columnid = c.trace_column_id where e.name = 'Audit Statement Permission Event'

'Audit Statement Permission Event' is just an arbitrary event. When a certain event isn't included in the trace file, the function returns an empty rowset. I've tried using a CASE stmt to inform me through the query whether or not that event is included and I'm coming up empty.

My CASE query looks like:
SELECT Event_Name = CASE e.name WHEN 'Audit Server Principal Impersonation' THEN 'being Audited' ELSE 'not being Audited' END FROM fn_trace_geteventinfo(1) ei JOIN sys.trace_events e ON ei.eventid = e.trace_event_id JOIN sys.trace_columns c ON ei.columnid = c.trace_column_id where e.name = 'Audit Server Principal Impersonation'

...but this isn't giving me the 'not being Audited' return value.

Am I doing something wrong?

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2012-01-04 : 17:57:58
IF NOT EXISTS (SELECT * FROM fn_trace_geteventinfo(1) ei JOIN sys.trace_events e ON ei.eventid = e.trace_event_id JOIN sys.trace_columns c ON ei.columnid = c.trace_column_id where e.name = 'Audit Statement Permission Event')
SELECT 'NOT BEING AUDITED'

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page
   

- Advertisement -