From: Bassam on
Hello,

I'm suspecting that a user in the network is using management studio or
other tool to login with his name behind the scenes and updating a certain
table , how can I monitor that event ? to know user
login/machine/time/statement used ?

PS. I can't use Profiler , is SQL Server itself have a log for that purpose
that I can see it ?

Thank you
Bassam


From: Erland Sommarskog on
Bassam (egbas(a)yahoo.com) writes:
> I'm suspecting that a user in the network is using management studio or
> other tool to login with his name behind the scenes and updating a certain
> table , how can I monitor that event ? to know user
> login/machine/time/statement used ?

The best option would be to set up a trigger that logs all changes to
a log table. YOu can use the system functions host_name, app_name(),
SYSTEM_USER and original_login() to get essential information. Beware
through, that the values returned by host_name() and app_name() are
settable by the user, and thus can be forged.


--
Erland Sommarskog, SQL Server MVP, esquel(a)sommarskog.se

Links for SQL Server Books Online:
SQL 2008: http://msdn.microsoft.com/en-us/sqlserver/cc514207.aspx
SQL 2005: http://msdn.microsoft.com/en-us/sqlserver/bb895970.aspx
SQL 2000: http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx