Download eBook (PDF) - Red Gate Software

9 – Honeycombing a Database• Action – the action or comma delimited list of actions to bemonitored.• Securable – the database object that is to be monitored.• Principal – the Database User, Database Role, or Application Rolethat is being monitored.• With State – defines whether the Database Audit Specification isactive (ON) or inactive (OFF).In the HomeLending database, we will create a Database Audit Specificationwith the name of Customer_Information_Spec and capture any SELECT,INSERT, UPDATE and DELETE events that are performed by the publicdatabase role, as shown in Listing 9-5.Use HomeLending;GOCREATE DATABASE AUDIT SPECIFICATIONCustomer_Information_SpecFOR SERVER AUDIT Honeycomb_AuditADD (SELECT, UPDATE, INSERT, DELETEON dbo.Customer_InformationBY public)WITH (STATE = ON);GOListing 9-5: Creating the Database Audit Specification object.All database users are members of the public database role; therefore we willknow when any user executes any of these methods on our decoy table.Reviewing the Windows Application LogBy executing a simple SELECT statement against our decoy table, in theHomeLending database, the Server Audit is initiated. Many pieces ofinformation are captured in the Windows Application Log, but the most criticalin identifying the event that occurred are shown in Table 9-1.192