|
| 1 | +/* |
| 2 | +https://technet.microsoft.com/en-us/library/dd822788%28v=sql.100%29.aspx?f=255&MSPPError=-2147217396 |
| 3 | +*/ |
| 4 | +---- Events |
| 5 | +SELECT p.name AS package, c.event, k.keyword, c.channel, c.description |
| 6 | +FROM |
| 7 | +( |
| 8 | +SELECT event_package=o.package_guid, o.description, |
| 9 | + event=c.object_name, channel=v.map_value |
| 10 | +FROM sys.dm_xe_objects o |
| 11 | + LEFT JOIN sys.dm_xe_object_columns c ON o.name = c.object_name |
| 12 | + INNER JOIN sys.dm_xe_map_values v ON c.type_name = v.name |
| 13 | + AND c.column_value = cast(v.map_key AS nvarchar) |
| 14 | +WHERE object_type='event' AND (c.name = 'channel' OR c.name IS NULL) |
| 15 | +) c left join |
| 16 | +( |
| 17 | + SELECT event_package=c.object_package_guid, event=c.object_name, |
| 18 | + keyword=v.map_value |
| 19 | + FROM sys.dm_xe_object_columns c INNER JOIN sys.dm_xe_map_values v |
| 20 | + ON c.type_name = v.name AND c.column_value = v.map_key |
| 21 | + AND c.type_package_guid = v.object_package_guid |
| 22 | + INNER JOIN sys.dm_xe_objects o ON o.name = c.object_name |
| 23 | + AND o.package_guid=c.object_package_guid |
| 24 | + WHERE object_type='event' AND c.name = 'keyword' |
| 25 | +) k |
| 26 | +ON |
| 27 | +k.event_package = c.event_package AND (k.event = c.event OR k.event IS NULL) |
| 28 | +INNER JOIN sys.dm_xe_packages p ON p.guid=c.event_package |
| 29 | +WHERE (p.capabilities IS NULL OR p.capabilities & 1 = 0) |
| 30 | +--and c.event like '%database%' |
| 31 | +ORDER BY channel, keyword, event |
| 32 | +---- Actions |
| 33 | +SELECT p.name AS PackageName, |
| 34 | + o.name AS ActionName, |
| 35 | + o.description AS ActionDescription |
| 36 | +FROM sys.dm_xe_objects o |
| 37 | + INNER JOIN sys.dm_xe_packages p |
| 38 | + ON o.package_guid = p.guid |
| 39 | +WHERE o.object_type = 'action' |
| 40 | + AND (p.capabilities IS NULL OR p.capabilities & 1 = 0) |
| 41 | +ORDER BY PackageName, ActionName; |
| 42 | +---- Targets |
| 43 | + |
| 44 | +---- Drop an event session |
| 45 | +DROP EVENT SESSION [HIPAA TPA EE] ON SERVER |
| 46 | +---- Create an event session |
| 47 | +CREATE EVENT SESSION [HIPAA TPA EE] ON SERVER |
| 48 | +ADD EVENT sqlserver.error_reported( |
| 49 | + ACTION(sqlserver.database_id,sqlserver.nt_username,sqlserver.sql_text,sqlserver.username) |
| 50 | + WHERE ([sqlserver].[database_id]=14)), |
| 51 | +ADD EVENT sqlserver.database_stopped( |
| 52 | + ACTION(sqlserver.nt_username) |
| 53 | + WHERE ([sqlserver].[database_id]=14)), |
| 54 | +ADD EVENT sqlserver.database_started( |
| 55 | + ACTION(sqlserver.nt_username) |
| 56 | + WHERE ([sqlserver].[database_id]=14)) |
| 57 | +ADD TARGET package0.asynchronous_file_target( |
| 58 | + SET filename='H:\MSSQL10_50.WEBTEST\MSSQL\Audit Files\HIPAA TPA EE.etl', metadatafile='H:\MSSQL10_50.WEBTEST\MSSQL\Audit Files\HIPAA TPA EE.mta') |
| 59 | + |
| 60 | +GO |
| 61 | + |
| 62 | +ALTER EVENT SESSION [HIPAA TPA EE] ON SERVER |
| 63 | +DROP EVENT sqlserver.database_stopped, |
| 64 | +DROP EVENT sqlserver.database_started |
| 65 | + |
| 66 | +---- Start an event session |
| 67 | +ALTER EVENT SESSION [HIPAA TPA EE] |
| 68 | +ON SERVER |
| 69 | +STATE=START |
| 70 | + |
| 71 | +---- Information about existing session |
| 72 | +select * from sys.server_event_sessions |
| 73 | +select * from sys.server_event_session_events where event_session_id = 65540 |
| 74 | +SELECT * FROM sys.server_event_session_actions where event_session_id = 65540 |
| 75 | + |
| 76 | + |
| 77 | +---- Read an EE file |
| 78 | +SELECT top 100 *, cast(event_data as xml) as targetdata |
| 79 | +FROM sys.fn_xe_file_target_read_file('H:\MSSQL10_50.WEBTEST\MSSQL\Audit Files\HIPAA TPA EE*etl', 'H:\MSSQL10_50.WEBTEST\MSSQL\Audit Files\HIPAA TPA EE*mta', null, null) |
| 80 | + |
| 81 | +---- Read from the ring buffer |
| 82 | +SELECT CAST(target_data as xml) AS targetdata |
| 83 | +INTO #capture_waits_data |
| 84 | +FROM sys.dm_xe_session_targets xet |
| 85 | +JOIN sys.dm_xe_sessions xes |
| 86 | + ON xes.address = xet.event_session_address |
| 87 | +WHERE xes.name = 'Ring Buffer - Track Waits' |
| 88 | + AND xet.target_name = 'ring_buffer'; |
| 89 | + |
| 90 | +---- Interpret data |
| 91 | +---- http://www.brentozar.com/archive/2015/01/query-extended-events-target-xml/ |
| 92 | +SELECT xed.event_data.value('(@timestamp)[1]', 'datetime2') AS [timestamp], |
| 93 | + xed.event_data.value('(data[@name="error"]/value)[1]', 'int') AS error, |
| 94 | + xed.event_data.value('(data[@name="severity"]/value)[1]', 'int') AS severity, |
| 95 | + xed.event_data.value('(data[@name="state"]/value)[1]', 'int') AS state, |
| 96 | + xed.event_data.value('(data[@name="message"]/value)[1]', 'varchar(200)') AS message, |
| 97 | + xed.event_data.value('(action[@name="nt_username"]/value)[1]', 'varchar(200)') AS nt_username, |
| 98 | + xed.event_data.value('(action[@name="username"]/value)[1]', 'varchar(200)') AS username, |
| 99 | + xed.event_data.value('(action[@name="sql_text"]/value)[1]', 'varchar(max)') AS sql_text |
| 100 | +FROM sys.fn_xe_file_target_read_file('H:\MSSQL10_50.WEBTEST\MSSQL\Audit Files\HIPAA TPA EE*etl', 'H:\MSSQL10_50.WEBTEST\MSSQL\Audit Files\HIPAA TPA EE*mta', null, null) |
| 101 | +--file |
| 102 | + CROSS APPLY (VALUES (CAST(event_data AS XML))) vals(targetdata) |
| 103 | + CROSS APPLY targetdata.nodes('//event') AS xed (event_data); |
| 104 | +--ring buffer |
| 105 | +-- CROSS APPLY targetdata.nodes('//RingBufferTarget/event') AS xed (event_data); |
| 106 | + |
| 107 | + |
| 108 | + |
| 109 | +----- Parse xel file |
| 110 | +SELECT |
| 111 | + [XML Data], |
| 112 | + [XML Data].value('(/event/@timestamp)[1]', 'datetime2') AS [timestamp], |
| 113 | + [XML Data].value('(/event/action[@name=''database_name'']/value)[1]','varchar(max)') AS [Database], |
| 114 | + [XML Data].value('(/event/data[@name=''duration'']/value)[1]','int') AS [Duration], |
| 115 | + [XML Data].value('(/event/action[@name=''session_id'']/value)[1]','int') AS [session_id], |
| 116 | + [XML Data].value('(/event/data[@name=''object_name'']/value)[1]','varchar(max)') AS [object_name], |
| 117 | + [XML Data].value('(/event/action[@name=''sql_text'']/value)[1]','varchar(max)') AS [sql_text] |
| 118 | + INTO #temp |
| 119 | +FROM |
| 120 | +(SELECT |
| 121 | + OBJECT_NAME AS [Event], |
| 122 | + CONVERT(XML, event_data) AS [XML Data] |
| 123 | + FROM sys.fn_xe_file_target_read_file |
| 124 | + ('C:\temp\WhatsGoingOn*.xel',NULL,NULL,NULL) |
| 125 | + where event_data like '%sql_text%') as x; |
0 commit comments