I have been asked to find out who created a certain Extended Events session on an Azure SQL Database. However, looking through the DMVs, there are plenty of attributes, but nothing to indicate when it was created, or by whom.
Is there a way to determine this?
Thank you.
In Azure this can be done but you have to have SQL Auditing enabled either on the database or server level. Then you have to execute the following using the
sys.fn_get_audit_file
function:This should give you back the information you need. Keep in mind that SQL Auditing can generate A LOT of data, so you may need to query the audit files per day or even per hour (you can read how date patterns are used with
sys.fn_get_audit_file
here).If you find the amount of data too big to query you can always download the audit files (.xel files, SQL Auditing is implemented via Extended Events) and write a custom tool to do that (Microsoft is offering a library to parse Extended Event files via LINQ. See details here).