Forum Discussion
SQL Server Audit Specification
Is it possible to predicate an Event in a Specification on a Principal Name?
The Specification 'Properties' dialogue box seem to indicate filtering on is possible, including 'Object Class', Object Schema', 'Object Name', a but the Syntax doesn't show how.
2 Replies
Thank you Jamony.
Is there a list of Actions in a specification that support principal scoping?
Is it possible to include a negative filter, such as 'NOT BY' ?You can scope many database audit actions to a principal inside the specification. The T-SQL form is an action on a securable followed by BY principal, for example SELECT ON DATABASE::YourDatabase BY YourUser. Supported combinations depend on the action and securable, so script and test the specification rather than assuming every action group supports principal scoping.
For server action groups or cases that cannot use BY, add a predicate to SERVER AUDIT using a supported field such as server_principal_name. That predicate affects everything written to the audit, so use a separate audit target when other specifications must remain unfiltered.
Identity fields can differ because of EXECUTE AS, contained users, application roles, or pooling. Capture an unfiltered sample first and determine whether server_principal_name, database_principal_name, session_server_principal_name, or original_login_name identifies the sessions. Then apply the narrow filter and verify both matching and nonmatching users before relying on it for compliance
