Showing posts with label frontend. Show all posts
Showing posts with label frontend. Show all posts

Thursday, March 8, 2012

Audit Table

The current environment is an ASP frontend with IIS 5.0
using (windows authentication) and SQL Server 2000(windows
authentication) on the same machine.
I would like to add two columns onto several tables and
have a timestamp and username inserted into them when a
user performs an update or insert. I believe it's a good
idea to use an insert or update trigger, but I'm not sure
how the asp application delegates who is logged to sql
server.
What is the best way to do this?
Do you need to have IIS and Sql server configured a
certain way in order to grab the username from the asp
application?Front-end code typically has to influence on a trigger. The trigger fires
as a result of the triggering action - INSERT, UPDATE or DELETE. Here's an
example to do what you want:
create trigger triu_MyTable on MyTable after insert, update
as
if @.@.ROWCOUNT = 0
return
update MyTable
set
LastModBy = CURRENT_USER
, LastUpdateDateTime = CURRENT_TIMESTAMP
where
PK in (select PK from inserted)
go
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinnaclepublishing.com/sql
.
"Michelle" <michelle.vanden@.eglin.af.mil> wrote in message
news:034501c3cdc5$1a2f3a60$a401280a@.phx.gbl...
The current environment is an ASP frontend with IIS 5.0
using (windows authentication) and SQL Server 2000(windows
authentication) on the same machine.
I would like to add two columns onto several tables and
have a timestamp and username inserted into them when a
user performs an update or insert. I believe it's a good
idea to use an insert or update trigger, but I'm not sure
how the asp application delegates who is logged to sql
server.
What is the best way to do this?
Do you need to have IIS and Sql server configured a
certain way in order to grab the username from the asp
application?|||Hi Michelle,
Thanks for your post. According to your description, I understand that you
want to record and return the current login username to certain table in
SQL Server, when you performed insert or update action. If I have
misunderstood, please feel free to let me know.
Before we go any further, I would like to collect more information from
you: 1. Which username do you want to record, the usernames used to log on
IIS or SQL Server?
2. Which authentication do you choose to log on IIS?
So far as I know, if we want to record the usernames used for SQL Server,
we can try to use suser_sname() to return the string of the current login
identification name
For more information regarding suser_sname function, please refer to the
following article on SQL Server Books Online.
Topic: "SUSER_SNAME"
On the SQL Server side, it seems hard to record the usernames which are
used to log on IIS.
Thanks for using MSDN newsgroup.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||1). Both IIS and SQL Server if possible. It would be
better if we get the username from IIS and have it
delegated to SQL Server.
2). Basic Authentication w/SSL on IIS on one machine and
windows Authentication w/SSL on another.
quote:

>--Original Message--
>Hi Michelle,
>Thanks for your post. According to your description, I

understand that you
quote:

>want to record and return the current login username to

certain table in
quote:

>SQL Server, when you performed insert or update action.

If I have
quote:

>misunderstood, please feel free to let me know.
>Before we go any further, I would like to collect more

information from
quote:

>you: 1. Which username do you want to record, the

usernames used to log on
quote:

>IIS or SQL Server?
>2. Which authentication do you choose to log on IIS?
>So far as I know, if we want to record the usernames used

for SQL Server,
quote:

>we can try to use suser_sname() to return the string of

the current login
quote:

>identification name
>For more information regarding suser_sname function,

please refer to the
quote:

>following article on SQL Server Books Online.
>Topic: "SUSER_SNAME"
>On the SQL Server side, it seems hard to record the

usernames which are
quote:

>used to log on IIS.
>Thanks for using MSDN newsgroup.
>Regards,
>Michael Shao
>Microsoft Online Partner Support
>Get Secure! - www.microsoft.com/security
>This posting is provided "as is" with no warranties and

confers no rights.
quote:

>
>.
>
|||Hi Michelle,
Thanks for your feedback. In this case, as IIS and SQL Server are on the
same machine, a user's credentials (username:password) will be used to
login to SQL Server after that user has logged into IIS using Basic
authentication.
We are able to record the login information (current login username and
timestamp) for SQL Server using the trigger and the related functions
(SUSER_SNAME, GETDATE() etc.). However, it seems impossible to monitor the
logins to IIS from the SQL Server side. SQL Server is unable to be used to
monitor the logins to IIS.
Please feel free to post in the group if this solves your problem or if you
would like further assistance.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.|||Hi Michelle,
How is this issue going on your side? Based on my further research, it
seems possible to monitor and record the logins to IIS via ASP programming.
To obtain the detailed information regarding monitoring the logins to IIS
using ASP, it is best that you can post in the ASP newsgroup, such as
microsoft.public.inetserver.asp.general,
microsoft.public.inetserver.asp.db. The ASP newsgroup is primarily for
issues involving ASP programming. The reason why we recommend posting
appropriately is you will get the most qualified pool of respondents, and
other partners who read the newsgroups regularly can either share their
knowledge or learn from your interaction with us.
Thanks for using Microsoft newsgroup.
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

Wednesday, March 7, 2012

Audit log that SA cannot modify

Anyone familiar with ways (SQL Server 2000, or 2005) to have an audit
log of who does what in the database (outside of a Great Plains front
end passing over requests) - that the SA cannot modify? If the SA - or
anyone - can modify the log - its no good from an audit perspective.
It has to be read-only. Any software packages out there that also do
this and present the log in a form thats easy to query / review?
Thanks!
Jason ShohetHi
In SQL Server 2005 you will be able to define a trigger on database level to
capture events.
<jasonshohet@.gmail.com> wrote in message
news:1139999866.893906.89260@.z14g2000cwz.googlegroups.com...
> Anyone familiar with ways (SQL Server 2000, or 2005) to have an audit
> log of who does what in the database (outside of a Great Plains front
> end passing over requests) - that the SA cannot modify? If the SA - or
> anyone - can modify the log - its no good from an audit perspective.
> It has to be read-only. Any software packages out there that also do
> this and present the log in a form thats easy to query / review?
> Thanks!
> Jason Shohet
>|||But the SA can disable the trigger, thats not enough.
I want something that can audit the SA himself - and anyone else. It
should report on all schema changes and all transactions made to the db
- by anyone - and nobody should be able to modify it (including the SA)
except truncate the log by date range at the end of the audit period.|||Hi
Don't you trust in SA? :-))))))
Remove people that you don't want from sysadmin server role and then you
audit them by using triggers
<jasonshohet@.gmail.com> wrote in message
news:1140012486.489277.187450@.g14g2000cwa.googlegroups.com...
> But the SA can disable the trigger, thats not enough.
> I want something that can audit the SA himself - and anyone else. It
> should report on all schema changes and all transactions made to the db
> - by anyone - and nobody should be able to modify it (including the SA)
> except truncate the log by date range at the end of the audit period.
>|||Ha, the issue is that the SA needs to be able to do this himself
but the SA role is necessary to perform maintenance on the SQL Server I
assume. Isn't there something that a QA person can install with the SA
watching perhaps - eg. a 3rd party logger, that can audit all
activities, that the SA cannot interfere with once installed. Pie in
the sky?|||Not pie in the sky. You can look at options with SQL Server
such as server side traces, maybe c2 auditing. Lots of third
party products that monitor activity - more products now
with SOX requirements. A couple of many would be AuditDB
from Lumigent: http://www.lumigent.com/products/auditdb.html
and Compliance Manager from Idera:
http://www.idera.com/Products/SQLcm/
-Sue
On 15 Feb 2006 14:15:29 -0800, jasonshohet@.gmail.com wrote:

>Ha, the issue is that the SA needs to be able to do this himself
>but the SA role is necessary to perform maintenance on the SQL Server I
>assume. Isn't there something that a QA person can install with the SA
>watching perhaps - eg. a 3rd party logger, that can audit all
>activities, that the SA cannot interfere with once installed. Pie in
>the sky?