Profiler 2000

I set up an audit trace while logged on to the server. After running it
for a while I logged out and found that the trace had stopped and
closed. I really had wanted to let it run for a couple of days -- we
are trying to figure out a SQL injection attack that defaced a website
this week. I am guessing that this will probably require running it
from a monitoring workstation while logged on, but is there perhaps a
way to leave a trace running while not logged on, whether on the server
or not? (because of other considerations w/ folder redirection and
profiles I can't leave the WS running overnight). BOL didn't help
Graham (Pete) Berry
PeteBerry@.Caltech.edu
Don't use profiler, use Trace instead. Profiler is just a gui that uses the
built in TRACE functionality. You can use profiler to setup the events and
columns you wish to trace. Then start and immediately stop the trace. Then
go to the menu under File and then Script Trace. This will give you a
template on how to create a file that holds the trace event data by filling
in the missing info as shown in the header of the file. When you run this
it will create a trace that runs independently of that connection so you can
log off and it will still run. See BOL for more details.
Andrew J. Kelly SQL MVP
"Pete Berry" <PeteBerry@.Caltech.edu> wrote in message
news:MPG.210fe7ec4cfeafbc989699@.msnews.microsoft.c om...
>I set up an audit trace while logged on to the server. After running it
> for a while I logged out and found that the trace had stopped and
> closed. I really had wanted to let it run for a couple of days -- we
> are trying to figure out a SQL injection attack that defaced a website
> this week. I am guessing that this will probably require running it
> from a monitoring workstation while logged on, but is there perhaps a
> way to leave a trace running while not logged on, whether on the server
> or not? (because of other considerations w/ folder redirection and
> profiles I can't leave the WS running overnight). BOL didn't help
> --
> Graham (Pete) Berry
> PeteBerry@.Caltech.edu
|||Hi Pete,
You can use the following system SP's. This approach, however, requires a
bit of work.
sp_trace_create
sp_trace_generateevent
sp_trace_setevent
sp_trace_setfilter
sp_trace_setstatus
fn_trace_gettable
You can also try to use SQL Trace Analyzer developed by Lakeside SQL which
you can download from here:
http://www.lakesidesql.com/TaDownload/ToTest/1.1.2007.813/TASetup.zip. Trace
scheduling is just a supplementary feature of the aplication. It provides
very granular trace filtering which can help you find what you're looking
for.
HTH.
"Andrew J. Kelly" <sqlmvpnooospam@.shadhawk.com> wrote in message
news:Ow%23m9eizHHA.484@.TK2MSFTNGP06.phx.gbl...
> Don't use profiler, use Trace instead. Profiler is just a gui that uses
> the built in TRACE functionality. You can use profiler to setup the events
> and columns you wish to trace. Then start and immediately stop the trace.
> Then go to the menu under File and then Script Trace. This will give you
> a template on how to create a file that holds the trace event data by
> filling in the missing info as shown in the header of the file. When you
> run this it will create a trace that runs independently of that connection
> so you can log off and it will still run. See BOL for more details.
> --
> Andrew J. Kelly SQL MVP
> "Pete Berry" <PeteBerry@.Caltech.edu> wrote in message
> news:MPG.210fe7ec4cfeafbc989699@.msnews.microsoft.c om...
>