views:

74

answers:

3

I'm looking for the easiest way to view what users are logging into my database. We have some old user accounts that might not be getting used anymore. Instead of just turning them off and seeing who complains, I thought there might be some way to monitor who logs in and runs some type of query over the next month or so. What would be the easiest way to monitor and track this kind of activity?

Edit: I would like to do this for all databases on the server.

+2  A: 

Run a profiler trace with the Audit Login event selected: or just select the Standard Trace Template (and perhaps limit the trace size).

See Using SQL Server Profiler

Mitch Wheat
You can also profile directly to a table, without the overhead of SQL Profiler, although it's a fairly expensive thing to do for a whole month unless your server is under light load.
RickNZ
A: 

The easiest way to do this would be with a third-party tool that's custom-written to do the work for you. Otherwise you have to fuss with (not SQL Profiler but) traces, regularly loading resulting data, and processing it, and for my money, that just is not an "easy" thing to do.

Not much help. The reason I'm posting is that just because someone (or something) hasn't logged in for a day, a week, or a month, does not mean that the account has gone derelict--I would only consider it an indication. I would recommend that once you've identified it as potentially derelict, then you disable it and see what happens. Give that a month, a quarter, or even a year (depends on your system) before actually deleting it.

(Of course, tracking that information over a month/quarter/year is yet more fuss and bother. Ideally, all accounts get created with deactivation/deletion rules, and their users/owners are informed of the rules under which they get to access the system. This probably won't help you now, but keep it in mind for the next system you design.)

Philip Kelley
+3  A: 

To see who's connecting, you can use Logon Triggers which allows you to log access. Running a trace for a month or 2 to audit login events may simply not work if you failover, restart SQL etc

However, to see what someone is doing after connection, then you'll really have to use Profiler like Mitch said

gbn
+1. This is the best way to go.
RickNZ