Showing posts with label auditing. Show all posts
Showing posts with label auditing. Show all posts

Saturday, February 25, 2012

C2 SQL auditing

Hi,
I setup my SQL 2000 Server to use C2 auditing. It is working.
My only problem is that my trace file does not get populated while I am
inserting/updating/select data or anything.
However, when I stop SQL server then my trace file gets populated.
I cannot stop a production SQL server on and off just to collect data and
the trace file is only limited to 200MB so I can wait till the end of day.
I am trying to do a audit report every 2hrs.
Am I doing something wrong? Or this is how C2 works?
I would appreciate all the help!Don't use the C2 auditing. Just create a custom trace that collects the data
you want and you can start and stop it as you need to. Check out
sp_trace_Create in BooksOnLine.
Andrew J. Kelly SQL MVP
"SQL apprentice" <mssqlworld@.yahoo.com> wrote in message
news:OYlONfeVHHA.3500@.TK2MSFTNGP05.phx.gbl...
> Hi,
> I setup my SQL 2000 Server to use C2 auditing. It is working.
> My only problem is that my trace file does not get populated while I am
> inserting/updating/select data or anything.
> However, when I stop SQL server then my trace file gets populated.
> I cannot stop a production SQL server on and off just to collect data and
> the trace file is only limited to 200MB so I can wait till the end of day.
> I am trying to do a audit report every 2hrs.
> Am I doing something wrong? Or this is how C2 works?
> I would appreciate all the help!
>|||Hi Andrew,
I had to setup C2 for my company just so they can see it in their own eyes.
I recommended them to use Server Side trace, it is more efficiency and
customizable to what they want to audit.
It would make my case even better when I tell them 3 SQL MVPs suggest not to
use C2.
Do you suggest any third party tools for SOX compliance? I am testing Idera
CM right now.
Eventually, I would like to off load the server side trace to the SOX team
since there are over 100 SQL Servers.
I would like to setup and manage so many traces.
Thanks again for the input...I greatly appreciated.
"Andrew J. Kelly" <sqlmvpnooospam@.shadhawk.com> wrote in message
news:OqOIdLiVHHA.3592@.TK2MSFTNGP03.phx.gbl...
> Don't use the C2 auditing. Just create a custom trace that collects the
data
> you want and you can start and stop it as you need to. Check out
> sp_trace_Create in BooksOnLine.
> --
> Andrew J. Kelly SQL MVP
> "SQL apprentice" <mssqlworld@.yahoo.com> wrote in message
> news:OYlONfeVHHA.3500@.TK2MSFTNGP05.phx.gbl...
and[vbcol=seagreen]
day.[vbcol=seagreen]
>|||I don't have a specific recomendation as the SOX requirements are very loose
and open to interpitation. There are a number of 3rd party tools that
monitor the logs.
http://sqlserver2000.databases.aspf...t
a.html
http://sqlserver2000.databases.aspf...
log-files.html
Andrew J. Kelly SQL MVP
"SQL apprentice" <mssqlworld@.yahoo.com> wrote in message
news:ufl7fZpVHHA.1636@.TK2MSFTNGP02.phx.gbl...
> Hi Andrew,
> I had to setup C2 for my company just so they can see it in their own
> eyes.
> I recommended them to use Server Side trace, it is more efficiency and
> customizable to what they want to audit.
> It would make my case even better when I tell them 3 SQL MVPs suggest not
> to
> use C2.
> Do you suggest any third party tools for SOX compliance? I am testing
> Idera
> CM right now.
> Eventually, I would like to off load the server side trace to the SOX team
> since there are over 100 SQL Servers.
> I would like to setup and manage so many traces.
> Thanks again for the input...I greatly appreciated.
> "Andrew J. Kelly" <sqlmvpnooospam@.shadhawk.com> wrote in message
> news:OqOIdLiVHHA.3592@.TK2MSFTNGP03.phx.gbl...
> data
> and
> day.
>

C2 Auditing: How to change to directory to save log files

I need to turn on C2 auditing on a sql 2K cluster server.
I do not have any space on C drive which according to the articles (and bol)
is the default place.
How I can change the directory so these traces can be save into the location
I want.
Any solid experience anyone has on C2?
Thank you,
ktf
Hi
C2 auditing writes to \mssql\data directory for default instances of SQL
Server 2000, or the \mssql$instancename\data directory for named instances.
If you change the default database data location in EM, or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\ MSSQLServer\DefaultData,
it will place them there.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"ktf" <ktf@.discussions.microsoft.com> wrote in message
news:D1ACF0EF-410E-4306-B826-17C76081C275@.microsoft.com...
> I need to turn on C2 auditing on a sql 2K cluster server.
> I do not have any space on C drive which according to the articles (and
bol)
> is the default place.
> How I can change the directory so these traces can be save into the
location
> I want.
> Any solid experience anyone has on C2?
> Thank you,
> ktf
>
|||Well Mr. Epprecht,
I have C and D drive which are the local drives and S and R from the SAN.
The only location that I can is on S drive. The registry setting is deferent.
Is there a specific registry object for that mater? I can try to run it and
see where it is saving it but is there a specific place that I can change the
setting that is for C2 ONLY?
Other question I have a passive site for disaster recovery (I am not talking
about passive node) do I have to replicate the trace data? The passive site
has a different virtual server name and ip address. As you know the sql is
sleep but I have a third party replication system going. Do you know if I
replace the trace that will be readable at the passive site?
Do you recommend any site for anything on C2?
Thank you,
ktf
"Mike Epprecht (SQL MVP)" wrote:

> Hi
> C2 auditing writes to \mssql\data directory for default instances of SQL
> Server 2000, or the \mssql$instancename\data directory for named instances.
> If you change the default database data location in EM, or
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\ MSSQLServer\DefaultData,
> it will place them there.
> Regards
> --
> --
> Mike Epprecht, Microsoft SQL Server MVP
> Zurich, Switzerland
> IM: mike@.epprecht.net
> MVP Program: http://www.microsoft.com/mvp
> Blog: http://www.msmvps.com/epprecht/
> "ktf" <ktf@.discussions.microsoft.com> wrote in message
> news:D1ACF0EF-410E-4306-B826-17C76081C275@.microsoft.com...
> bol)
> location
>
>

C2 Auditing: How to change to directory to save log files

I need to turn on C2 auditing on a sql 2K cluster server.
I do not have any space on C drive which according to the articles (and bol)
is the default place.
How I can change the directory so these traces can be save into the location
I want.
Any solid experience anyone has on C2?
Thank you,
ktfHi
C2 auditing writes to \mssql\data directory for default instances of SQL
Server 2000, or the \mssql$instancename\data directory for named instances.
If you change the default database data location in EM, or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\DefaultData,
it will place them there.
Regards
--
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"ktf" <ktf@.discussions.microsoft.com> wrote in message
news:D1ACF0EF-410E-4306-B826-17C76081C275@.microsoft.com...
> I need to turn on C2 auditing on a sql 2K cluster server.
> I do not have any space on C drive which according to the articles (and
bol)
> is the default place.
> How I can change the directory so these traces can be save into the
location
> I want.
> Any solid experience anyone has on C2?
> Thank you,
> ktf
>|||Well Mr. Epprecht,
I have C and D drive which are the local drives and S and R from the SAN.
The only location that I can is on S drive. The registry setting is deferent.
Is there a specific registry object for that mater? I can try to run it and
see where it is saving it but is there a specific place that I can change the
setting that is for C2 ONLY?
Other question I have a passive site for disaster recovery (I am not talking
about passive node) do I have to replicate the trace data? The passive site
has a different virtual server name and ip address. As you know the sql is
sleep but I have a third party replication system going. Do you know if I
replace the trace that will be readable at the passive site?
Do you recommend any site for anything on C2?
Thank you,
ktf
"Mike Epprecht (SQL MVP)" wrote:
> Hi
> C2 auditing writes to \mssql\data directory for default instances of SQL
> Server 2000, or the \mssql$instancename\data directory for named instances.
> If you change the default database data location in EM, or
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\DefaultData,
> it will place them there.
> Regards
> --
> --
> Mike Epprecht, Microsoft SQL Server MVP
> Zurich, Switzerland
> IM: mike@.epprecht.net
> MVP Program: http://www.microsoft.com/mvp
> Blog: http://www.msmvps.com/epprecht/
> "ktf" <ktf@.discussions.microsoft.com> wrote in message
> news:D1ACF0EF-410E-4306-B826-17C76081C275@.microsoft.com...
> >
> > I need to turn on C2 auditing on a sql 2K cluster server.
> > I do not have any space on C drive which according to the articles (and
> bol)
> > is the default place.
> > How I can change the directory so these traces can be save into the
> location
> > I want.
> > Any solid experience anyone has on C2?
> >
> > Thank you,
> > ktf
> >
>
>

C2 Auditing: How to change to directory to save log files

I need to turn on C2 auditing on a sql 2K cluster server.
I do not have any space on C drive which according to the articles (and bol)
is the default place.
How I can change the directory so these traces can be save into the location
I want.
Any solid experience anyone has on C2?
Thank you,
ktfHi
C2 auditing writes to \mssql\data directory for default instances of SQL
Server 2000, or the \mssql$instancename\data directory for named instances.
If you change the default database data location in EM, or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS
SQLServer\MSSQLServer\DefaultData,
it will place them there.
Regards
--
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"ktf" <ktf@.discussions.microsoft.com> wrote in message
news:D1ACF0EF-410E-4306-B826-17C76081C275@.microsoft.com...
> I need to turn on C2 auditing on a sql 2K cluster server.
> I do not have any space on C drive which according to the articles (and
bol)
> is the default place.
> How I can change the directory so these traces can be save into the
location
> I want.
> Any solid experience anyone has on C2?
> Thank you,
> ktf
>|||Well Mr. Epprecht,
I have C and D drive which are the local drives and S and R from the SAN.
The only location that I can is on S drive. The registry setting is deferent
.
Is there a specific registry object for that mater? I can try to run it and
see where it is saving it but is there a specific place that I can change th
e
setting that is for C2 ONLY?
Other question I have a passive site for disaster recovery (I am not talking
about passive node) do I have to replicate the trace data? The passive site
has a different virtual server name and ip address. As you know the sql is
sleep but I have a third party replication system going. Do you know if I
replace the trace that will be readable at the passive site?
Do you recommend any site for anything on C2?
Thank you,
ktf
"Mike Epprecht (SQL MVP)" wrote:

> Hi
> C2 auditing writes to \mssql\data directory for default instances of SQL
> Server 2000, or the \mssql$instancename\data directory for named instances
.
> If you change the default database data location in EM, or
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS
SQLServer\MSSQLServer\DefaultData,
> it will place them there.
> Regards
> --
> --
> Mike Epprecht, Microsoft SQL Server MVP
> Zurich, Switzerland
> IM: mike@.epprecht.net
> MVP Program: http://www.microsoft.com/mvp
> Blog: http://www.msmvps.com/epprecht/
> "ktf" <ktf@.discussions.microsoft.com> wrote in message
> news:D1ACF0EF-410E-4306-B826-17C76081C275@.microsoft.com...
> bol)
> location
>
>

C2 auditing path?

How can I specify the c2 auditing files path?Hi
The files will be in the default data directory which you can change.
John
"Artificer" wrote:
> How can I specify the c2 auditing files path?
>|||How to specify that?
"John Bell" wrote:
> Hi
> The files will be in the default data directory which you can change.
> John
> "Artificer" wrote:
> > How can I specify the c2 auditing files path?
> >
> >|||Hi
The easiest way is to change it on the database tab of the server properties
dialog in Enterprise Manager and restart SQL Server.
John
"Joseph" wrote:
> How to specify that?
> "John Bell" wrote:
> > Hi
> >
> > The files will be in the default data directory which you can change.
> >
> > John
> >
> > "Artificer" wrote:
> >
> > > How can I specify the c2 auditing files path?
> > >
> > >|||If the database tab of the server properties is changed, what will the new
default database destination be? The one described in the database tab or the
one of the model db?
Î? Ï?Ï?ήÏ?Ï?ηÏ? "John Bell" έγγÏ?αÏ?ε:
> Hi
> The easiest way is to change it on the database tab of the server properties
> dialog in Enterprise Manager and restart SQL Server.
> John
> "Joseph" wrote:
> > How to specify that?
> >
> > "John Bell" wrote:
> >
> > > Hi
> > >
> > > The files will be in the default data directory which you can change.
> > >
> > > John
> > >
> > > "Artificer" wrote:
> > >
> > > > How can I specify the c2 auditing files path?
> > > >
> > > >|||Hi
New databases data files will be created in the directory that you have
chanegd on the database tab of the server properties dialog. This directory
does not have to be the same location as the system databases.
If you don't want to create the data and log files in the default
directories you can either overwrite them in the new database dialogs data
file and log file tabs or use Query analyser to specify explicitly the CREATE
DATABASE statement.
John
"blackpit" wrote:
> If the database tab of the server properties is changed, what will the new
> default database destination be? The one described in the database tab or the
> one of the model db?
> Î? Ï?Ï?ήÏ?Ï?ηÏ? "John Bell" έγγÏ?αÏ?ε:
> > Hi
> >
> > The easiest way is to change it on the database tab of the server properties
> > dialog in Enterprise Manager and restart SQL Server.
> >
> > John
> >
> > "Joseph" wrote:
> >
> > > How to specify that?
> > >
> > > "John Bell" wrote:
> > >
> > > > Hi
> > > >
> > > > The files will be in the default data directory which you can change.
> > > >
> > > > John
> > > >
> > > > "Artificer" wrote:
> > > >
> > > > > How can I specify the c2 auditing files path?
> > > > >
> > > > >|||It is clear.
Thank you
Î? Ï?Ï?ήÏ?Ï?ηÏ? "John Bell" έγγÏ?αÏ?ε:
> Hi
> New databases data files will be created in the directory that you have
> chanegd on the database tab of the server properties dialog. This directory
> does not have to be the same location as the system databases.
> If you don't want to create the data and log files in the default
> directories you can either overwrite them in the new database dialogs data
> file and log file tabs or use Query analyser to specify explicitly the CREATE
> DATABASE statement.
> John
> "blackpit" wrote:
> > If the database tab of the server properties is changed, what will the new
> > default database destination be? The one described in the database tab or the
> > one of the model db?
> >
> > Î? Ï?Ï?ήÏ?Ï?ηÏ? "John Bell" έγγÏ?αÏ?ε:
> >
> > > Hi
> > >
> > > The easiest way is to change it on the database tab of the server properties
> > > dialog in Enterprise Manager and restart SQL Server.
> > >
> > > John
> > >
> > > "Joseph" wrote:
> > >
> > > > How to specify that?
> > > >
> > > > "John Bell" wrote:
> > > >
> > > > > Hi
> > > > >
> > > > > The files will be in the default data directory which you can change.
> > > > >
> > > > > John
> > > > >
> > > > > "Artificer" wrote:
> > > > >
> > > > > > How can I specify the c2 auditing files path?
> > > > > >
> > > > > >|||Thanks!

C2 auditing path?

How can I specify the c2 auditing files path?Hi
The files will be in the default data directory which you can change.
John
"Artificer" wrote:

> How can I specify the c2 auditing files path?
>|||How to specify that?
"John Bell" wrote:
[vbcol=seagreen]
> Hi
> The files will be in the default data directory which you can change.
> John
> "Artificer" wrote:
>|||Hi
The easiest way is to change it on the database tab of the server properties
dialog in Enterprise Manager and restart SQL Server.
John
"Joseph" wrote:
[vbcol=seagreen]
> How to specify that?
> "John Bell" wrote:
>|||If the database tab of the server properties is changed, what will the new
default database destination be? The one described in the database tab or th
e
one of the model db?
Ο χρ?στη? "John Bell" _γγραψε:
[vbcol=seagreen]
> Hi
> The easiest way is to change it on the database tab of the server properti
es
> dialog in Enterprise Manager and restart SQL Server.
> John
> "Joseph" wrote:
>|||Hi
New databases data files will be created in the directory that you have
chanegd on the database tab of the server properties dialog. This directory
does not have to be the same location as the system databases.
If you don't want to create the data and log files in the default
directories you can either overwrite them in the new database dialogs data
file and log file tabs or use Query analyser to specify explicitly the CREAT
E
DATABASE statement.
John
"blackpit" wrote:
[vbcol=seagreen]
> If the database tab of the server properties is changed, what will the new
> default database destination be? The one described in the database tab or
the
> one of the model db?
> Ο χρ?στη? "John Bell" _γγραψε:
>|||It is clear.
Thank you
Ο χρ?στη? "John Bell" _γγραψε:
[vbcol=seagreen]
> Hi
> New databases data files will be created in the directory that you have
> chanegd on the database tab of the server properties dialog. This director
y
> does not have to be the same location as the system databases.
> If you don't want to create the data and log files in the default
> directories you can either overwrite them in the new database dialogs data
> file and log file tabs or use Query analyser to specify explicitly the CRE
ATE
> DATABASE statement.
> John
> "blackpit" wrote:
>|||Thanks!

C2 auditing on SQL Server

I currently have C2 auditing turned on for a server, and an audit trace file
gets written to the default database directory every couple of hours. Is
there a way to get C2 auditing to write to a separate database for querying?
And is there also a way to turn C2 on/off without restarting the server?
Is C2 the appropriate tool for internal auditing, or is there a
better tool out there for getting reports, etc?
cross posted to .securitytools
Thanks,
-RSHi,
A normal profiler using the properties windows can save the contents to a
table. I am not sure on how tyo automate this in C2 auditing, because
it craetes seperate files.
And is there also a way to turn C2 on/off without restarting the server?
No.
Is C2 the appropriate tool for internal auditing, or is there a better tool
out there for getting reports, etc?
Yes, But might not be useful for reporting. Take a look into the product
from lumigent
http://www.lumigent.com/Downloads/
Have a look into the below site for more information on c2 Audit
http://msdn.microsoft.com/library/d...-us/adminsql/ad
_security_2ard.asp
Thanks
Hari
MCDBA
"RS" <rspen@.yahoo.com> wrote in message
news:e$4zwZ2CEHA.3748@.TK2MSFTNGP11.phx.gbl...
> I currently have C2 auditing turned on for a server, and an audit trace
file
> gets written to the default database directory every couple of hours. Is
> there a way to get C2 auditing to write to a separate database for
querying?
> And is there also a way to turn C2 on/off without restarting the server?
> Is C2 the appropriate tool for internal auditing, or is there a
> better tool out there for getting reports, etc?
> cross posted to .securitytools
> Thanks,
> -RS
>|||C2 auditing is primary for forensics purposes and not meant to be used for r
eporting. The logs themselves write to 200mb and then roll over, so it's a
hassle at best to try and get anything meaningful from a reporting standpoin
t. I'd recommend running a
different profile for what you specifically want.|||Thanks..that helps. I think we are going to look at Lumigent, but it is
pricey. Is there anything that offers a good reporting tool for trace files
without being so expensive? Maybe there is a market opportunity here.
-RS
"binary_designs" <anonymous@.discussions.microsoft.com> wrote in message
news:A0B925B8-6ACC-4802-9BBB-26882634DCB2@.microsoft.com...
> C2 auditing is primary for forensics purposes and not meant to be used for
reporting. The logs themselves write to 200mb and then roll over, so it's a
hassle at best to try and get anything meaningful from a reporting
standpoint. I'd recommend running a different profile for what you
specifically want.

C2 auditing ?

Hello there
I just inherited a data farm and I noticed that the person before me had c2
auditing turned on.
I noticed that the trc files date only back to 04/05 and that the last time
a fiel has been modified is yesterday.
the rate of growing out of 200mb should make these files date of once a day
or even 2. does anybody know how I can check if c2 is still turned on ? or
any idea why that is ? I suppoe i can wait another couple of days and see
but ...
thanks
>> does anybody know how I can check if c2 is still turned on ?
You can use sp_configure look for the running value for c2 audit mode.
Anith

C2 auditing ?

Hello there
I just inherited a data farm and I noticed that the person before me had c2
auditing turned on.
I noticed that the trc files date only back to 04/05 and that the last time
a fiel has been modified is yesterday.
the rate of growing out of 200mb should make these files date of once a day
or even 2. does anybody know how I can check if c2 is still turned on ? or
any idea why that is ? I suppoe i can wait another couple of days and see
but ...
thanks>> does anybody know how I can check if c2 is still turned on ?
You can use sp_configure look for the running value for c2 audit mode.
--
Anith

C2 auditing ?

Hello there
I just inherited a data farm and I noticed that the person before me had c2
auditing turned on.
I noticed that the trc files date only back to 04/05 and that the last time
a fiel has been modified is yesterday.
the rate of growing out of 200mb should make these files date of once a day
or even 2. does anybody know how I can check if c2 is still turned on ? or
any idea why that is ? I suppoe i can wait another couple of days and see
but ...
thanks>> does anybody know how I can check if c2 is still turned on ?
You can use sp_configure look for the running value for c2 audit mode.
Anith

c2 auditing

Is there any way to granularise what c2 monitors? I have a system which is
generating thousands of trades and this is in turn generating a 200Mb c2
trace every 1 minute.
What kind of trading system would use C2 audit?
Linchi
"guest5" wrote:

> Is there any way to granularise what c2 monitors? I have a system which is
> generating thousands of trades and this is in turn generating a 200Mb c2
> trace every 1 minute.

c2 auditing

Is there any way to granularise what c2 monitors? I have a system which is
generating thousands of trades and this is in turn generating a 200Mb c2
trace every 1 minute.> Is there any way to granularise what c2 monitors?
That would mean it isn't a c2 trace anymore... ;-)
You can create your own server-side traces, however, and make them autostart
using sp_procoption.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"guest5" <guest5@.discussions.microsoft.com> wrote in message
news:EA8A7A35-E793-4537-B8B1-EC7AEF9C7D7D@.microsoft.com...
> Is there any way to granularise what c2 monitors? I have a system which is
> generating thousands of trades and this is in turn generating a 200Mb c2
> trace every 1 minute.|||What kind of trading system would use C2 audit?
Linchi
"guest5" wrote:

> Is there any way to granularise what c2 monitors? I have a system which is
> generating thousands of trades and this is in turn generating a 200Mb c2
> trace every 1 minute.

c2 auditing

Is there any way to granularise what c2 monitors? I have a system which is
generating thousands of trades and this is in turn generating a 200Mb c2
trace every 1 minute.> Is there any way to granularise what c2 monitors?
That would mean it isn't a c2 trace anymore... ;-)
You can create your own server-side traces, however, and make them autostart using sp_procoption.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"guest5" <guest5@.discussions.microsoft.com> wrote in message
news:EA8A7A35-E793-4537-B8B1-EC7AEF9C7D7D@.microsoft.com...
> Is there any way to granularise what c2 monitors? I have a system which is
> generating thousands of trades and this is in turn generating a 200Mb c2
> trace every 1 minute.|||What kind of trading system would use C2 audit?
Linchi
"guest5" wrote:
> Is there any way to granularise what c2 monitors? I have a system which is
> generating thousands of trades and this is in turn generating a 200Mb c2
> trace every 1 minute.