MS SQL Server Audit Events
Event ID Description
24000 Audit event in SQL server
24001 Login succeeded in SQL server
24002 Logout succeeded in SQL server
24003 Login failed in SQL server
24004 Change own password succeeded in SQL server
24005 Change own password failed in SQL server
24006 Change password succeeded in SQL server
24007 Change password failed in SQL server
24008 Reset own password succeeded in SQL server
24009 Reset own password failed in SQL server
24010 Reset password succeeded in SQL server
24011 Reset password failed in SQL server
24012 User must change password in SQL server
24013 User account unlocked in SQL server
24014 Application role password successfully changed in SQL server
24015 Application role password change failed in SQL server
24016 Add member to SQL server role succeeded
24017 Add member to SQL server role failed
24018 Remove member from SQL server role succeeded
24019 Remove member from SQL server role failed
24020 Add member to database role in SQL server succeeded
24021 Add member to database role in SQL server failed
24022 Remove member from database role in SQL server succeeded
24023 Remove member from database role in SQL server failed
24024 Database backup command issued in SQL server
24025 Transaction log backup command issued in SQL server
24026 Database restore command issued in SQL server
24027 Transaction log restore command issued in SQL server
24028 Database console command issued in SQL server
24029 Bulk administration command issued in SQL server
24030 Alter connection command issued in SQL server
24031 Alter resources command issued in SQL server
24032 Alter server state command issued in SQL server
24033 Alter server settings command issuedin SQL server
24034 View server state command issued in SQL server
24035 External access assembly command issued in SQL server
24036 Unsafe assembly command issued in SQL server
24037 Alter resource governor command issued in SQL server
24038 Database authenticate command issued in SQL server
24039 Database checkpoint command issued in SQL server
24040 Database show plan command issued in SQL server
24041 Subscribe to query information command issued in SQL server
24042 View database state command issued in SQL server
24043 Change server audit command issued in SQL server
24044 Change server audit specification command issued in SQL server
24045 Change database audit specification command issued in SQL server
24046 Create server audit command issued in SQL server
24047 Create server audit specification command issued in SQL server
24048 Create database audit specification command issued in SQL server
24049 Delete server audit command issued in SQL server
24050 Delete server audit specification command issued in SQL server
24051 Delete database audit specification command issued in SQL server
24052 Audit failure in SQL server
24053 Audit session changed in SQL server
24054 SQL server started
24055 SQL server paused
24056 SQL server resumed
24057 SQL server stopped
24058 Create server object command issued in SQL server
24059 Change server object command issued in SQL server
24060 Delete server object command issued in SQL server
24061 Create server setting command issued in SQL server
24062 Change server setting command issued in SQL server
24063 Delete server setting command issued in SQL server
24064 Create server cryptographic provider command issued in SQL server
24065 Delete server cryptographic provider command issued in SQL server
24066 Change server cryptographic provider command issued in SQL server
24067 Create server credential command issued in SQL server
24068 Delete server credential command issued in SQL server
24069 Change server credential command issued in SQL server
24070 Change server master key command issued in SQL server
24071 Back up server master key command issued in SQL server
24072 Restore server master key command issued in SQL server
24073 Map server credential to login command issued in SQL server
24074 Remove map between server credential and login command issued in SQL server
24075 Create server principal command issued in SQL server
24076 Delete server principal command issued in SQL server
24077 Change server principal credentials command issued in SQL server
24078 Disable server principal command issued in SQL server
24079 Change server principal default database command issued in SQL server
24080 Enable server principal command issued in SQL server
24081 Change server principal default language command issued in SQL server
24082 Change server principal password expiration command issued in SQL server
24083 Change server principal password policy command issued in SQL server
24084 Change server principal name command issued in SQL server
24085 Create database command issued in SQL server
24086 Change database command issued in SQL server
24087 Delete database command issued in SQL server
24088 Create certificate command issued in SQL server
24089 Change certificate command issued in SQL server
24090 Delete certificate command issued in SQL server
24091 Back up certificate command issued in SQL server
24092 Access certificate command issued in SQL server
24093 Create asymmetric key command issued in SQL server
24094 Change asymmetric key command issued in SQL server
24095 Delete asymmetric key command issued in SQL server
24096 Access asymmetric key command issued in SQL server
24097 Create database master key command issued in SQL server
24098 Change database master key command issued in SQL server
24099 Delete database master key command issued in SQL server
24100 Back up database master key command issued in SQL server
24101 Restore database master key command in SQL server
24102 Open database master key command issued in SQL server
24103 Create database symmetric key command issued in SQL server
24104 Change database symmetric key command issued in SQL server
24105 Delete database symmetric key command issued in SQL server
24106 Back up database symmetric key command issued in SQL server
24107 Open database symmetric key command issued in SQL server
24108 Create database object command issued in SQL server
24109 Change database object command issued in SQL server
24110 Delete database object command issued in SQL server
24111 Access database object command issued in SQL server
24112 Create assembly command issued in SQL server
24113 Change assembly command issued in SQL server
24114 Delete assembly command issued in SQL server
24115 Create schema command issued in SQL server
24116 Change schema command issued in SQL server
24117 Delete schema command issued in SQL server
24118 Create database encryption key command issued in SQL server
24119 Change database encryption key command issued in SQL server
24120 Delete database encryption key command issued in SQL server
24121 Create database user command issued in SQL server
24122 Change database user command issued in SQL server
24123 Delete database user command issued in SQL server
24124 Create database role command issued in SQL server
24125 Change database role command issued in SQL server
24126 Delete database role command issued in SQL server
24127 Create application role command issued in SQL server
24128 Change application role command issued in SQL server
24129 Create application role command issued in SQL server
24130 Change database user login command issued in SQL server
24131 Auto-change database user login command issued in SQL server
24132 Create schema object command issued in SQL server
24133 Change schema object command issued in SQL server
24134 Delete schema object command issued in SQL server
24135 Transfer schema object command issued in SQL server
24136 Create schema type command issued in SQL server
24137 Change schema type command issued in SQL server
24138 Delete schema type command issued in SQL server
24139 Transfer schema type command issued in SQL server
24140 Create XML schema collection command issued in SQL server
24141 Change XML schema collection command issued in SQL server
24142 Delete XML schema collection command issued in SQL server
24143 Transfer XML schema collection command issued in SQL server
24144 Impersonate within server scope command issued in SQL server
24145 Impersonate within database scope command issued in SQL server
24146 Change server object owner command issued in SQL server
24147 Change database owner command issued in SQL server
24148 Change schema owner command issued in SQL server
24150 Change role owner command issued in SQL server
24151 Change database object owner command issued in SQL server
24152 Change symmetric key owner command issued in SQL server
24153 Change certificate owner command issued in SQL server
24154 Change asymmetric key owner command issued in SQL server
24155 Change schema object owner command issued in SQL server
24156 Change schema type owner command issued in SQL server
24157 Change XML schema collection owner command issued in SQL server
24158 Grant permissions succeeded in SQL server
24159 Grant permissions failed in SQL server
24160 Grant server permissions with grant succeeded in SQL server
24161 Grant server permissions with grant failed in SQL server
24162 Deny server permissions succeeded in SQL server
24163 Deny server permissions failed in SQL server
24164 Deny server permissions with cascade succeeded in SQL server
24165 Deny server permissions with cascade failed in SQL server
24166 Revoke server permissions succeeded in SQL server
24167 Revoke server permissions failed in SQL server
24168 Revoke server permissions with grant succeeded in SQL server
24169 Revoke server permissions with grant failed in SQL server
24170 Revoke server permissions with cascade succeeded in SQL server
24171 Revoke server permissions with cascade failed in SQL server
24172 Grant server object permissions command issued in SQL server
24173 Grant server object permissions with grant command issued in SQL server
24174 Deny server object permissions command issued in SQL server
24175 Deny server object permissions with cascade command issued in SQL server
24176 Revoke server object permissions command issued in SQL server
24177 Revoke server object permissions with grant command issued in SQL server
24178 Revoke server object permissions with cascade command issued in SQL server
24179 Grant database permissions succeeded in SQL server
24180 Grant database permissions failed in SQL server
24181 Grant database permissions with grant succeeded in SQL server
24182 Grant database permissions with grant failed in SQL server
24183 Deny database permissions succeeded in SQL server
24184 Deny database permissions failed in SQL server
24185 Deny database permissions with cascade succeeded in SQL server
24186 Deny database permissions with cascade failed in SQL server
24187 Revoke database permissions succeeded in SQL server
24188 Revoke server permissions failed in SQL server
24189 Revoke database permissions with grant succeeded in SQL server
24190 Revoke database permissions with grant failed in SQL server
24191 Revoke database permissions with cascade succeeded in SQL server
24192 Revoke database permissions with cascade failed in SQL server
24193 Grant database object permissions command issued in SQL server
24194 Grant database object permissions with grant command issued in SQL server
24195 Deny server object permissions command issued in SQL server
24196 Deny database object permissions with cascade command issued in SQL server
24197 Revoke database object permissions command issued in SQL server
24198 Revoke database object permissions with grant command issued in SQL server
24199 Revoke database object permissions with cascade command issued in SQL server
24200 Grant schema permissions command issued in SQL server
24201 Grant schema permissions with grant command issued in SQL server
24202 Deny schema permissions command issued in SQL server
24203 Deny schema permissions with cascade command issued in SQL server
24204 Revoke schema permissions command issued in SQL server
24205 Revoke schema permissions with grant command issued in SQL server
24206 Revoke schema permissions with cascade command issued in SQL server
24207 Grant assembly permissions command issued in SQL server
24208 Grant assembly permissions with grant command issued in SQL server
24209 Deny assembly permissions command issued in SQL server
24210 Deny assembly permissions with cascade command issued in SQL server
24211 Revoke assembly permissions command issued in SQL server
24212 Revoke assembly permissions with grant command issued in SQL server
24213 Revoke assembly permissions with cascade command issued in SQL server
24214 grant database role permissions command issued in SQL server
24215 Grant database role permissions with grant command issued in SQL server
24216 Deny database role permissions command issued in SQL server
24217 Deny database role permissions with cascade command issued in SQL server
24218 Revoke database role permissions command issued in SQL server
24219 Revoke database role permissions with grant command issued in SQL server
24220 Revoke database role permissions with cascade command issued in SQL server
24221 Grant application role permissions command issued in SQL server
24222 Grant application role permissions command issued in SQL server
24223 Deny application role permissions command issued in SQL server
24224 Deny application role permissions with cascade command issued in SQL server
24225 Revoke application role permissions command issued in SQL server
24226 Revoke application role permissions with grant command issued in SQL server
24227 Revoke application role permissions with cascade command issued in SQL server
24228 Grant symmetric key permissions command issued in SQL server
24229 grant symmetric key permissions with grant command issued in SQL server
24230 Deny symmetric key permissions command issued in SQL server
24231 Deny symmetric key permissions with cascade command issued in SQL server
24232 Revoke application role permissions command issued in SQL server
24233 Revoke symmetric key permissions with grant command issued in SQL server
24234 Revoke symmetric key permissions with grant command issued in SQL server
24235 Grant certificate permissions command issued in SQL server
24236 Grant certificate permissions with grant command issued in SQL server
24237 Deny certificate permissions command issued in SQL server
24238 Deny certificate permissions with cascade command issued in SQL server
24239 Revoke certificate permissions command issued in SQL server
24240 Revoke certificate permissions with grant command issued in SQL server
24241 Revoke certificate permissions with cascade command issued in SQL server
24242 Grant asymmetric key permissions command issued in SQL server
24243 Grant asymmetric key permissions with grant command issued in SQL server
24244 Deny asymmetric key permissions command issued in SQL server
24245 Deny asymmetric key permissions with cascade command issued in SQL server
24246 Revoke asymmetric key permissions command issued in SQL server
24247 Revoke asymmetric key permissions with grant command issued in SQL server
24248 Revoke asymmetric key permissions command issued in SQL server
24249 Grant schema object permissions command issued in SQL server
24250 Grant schema object permissions with grant command issued in SQL server
24251 Deny schema object permissions command issued in SQL server
24252 Deny schema object permissions with cascade command issued in SQL server
24253 Revoke schema object permissions command issued in SQL server
24254 Revoke schema object permissions with grant command issued in SQL server
24255 Revoke schema object permissions with cascade command issued in SQL server
24256 Grant schema type permissions command issued in SQL server
24257 Grant schema type permissions with grant command issued in SQL server
24258 Deny schema type permissions command issued in SQL server
24259 Deny schema type permissions with cascade command issued in SQL server
24260 Revoke schema type permissions command issued in SQL server
24261 Revoke schema type permissions with grant command issued in SQL server
24262 Revoke schema type permissions with cascade command issued in SQL server
24263 Grant XML schema collection permissions command issued in SQL server
24264 Grant XML schema collection permissions with grant command issued in SQL server
24265 Deny XML schema collection permissions command issued in SQL server
24266 Deny XML schema collection permissions with cascade command issued in SQL server
24267 RevokeÿXML schema collection permissions command issued in SQL server
24268 Revoke XML schema collection permissions with grant command issued in SQL server
24269 Revoke XML schema collection permissions with cascade command issued in SQL server
24270 Reference database object permissions command issued in SQL server
24271 Send service request command issued in SQL server
24272 Check permissions with schema command issued in SQL server
24273 Use service broker transport security command issued in SQL server
24274 Use database mirroring transport security command issued in SQL server
24275 Alter trace command issued in SQL server
24276 Start trace command issued in SQL server
24277 Stop trace command issued in SQL server
24278 Enable trace C2 audit mode command issued in SQL server
24279 Disable trace C2 audit mode command issued in SQL server
24280 Server full-text command issued in SQL server
24281 Select command issued in SQL server
24282 Update command issued in SQL server
24283 Insert command issued in SQL server
24284 Delete command issued in SQL server
24285 Execute command issued in SQL server
24286 Receive command issued in SQL server
24287 Check references command issued in SQL server
24288 Create user-defined server role command issued in SQL server
24289 Change user-defined server role command issued in SQL server
24290 Delete user-defined server role command issued in SQL server
24291 Grant user-defined server role permissions command issued in SQL server
24292 Grant user-defined server role permissions with grant command issued in SQL server
24293 Deny user-defined server role permissions command issued in SQL server
24294 Deny user-defined server role permissions with cascade command issued in SQL server
24295 Revoke user-defined server role permissions command issued in SQL server
24296 Revoke user-defined server role permissions with grant command issued in SQL server
24297 Revoke user-defined server role permissions with cascade command issued in SQL server
24298 Database login succeeded in SQL server
24299 Database login failed in SQL server
24300 Database logout succeeded in SQL server
24301 Change database password succeeded in SQL server
24302 Change database password failed in SQL server
24303 Change own database password succeeded in SQL server
24304 Change own database password failed in SQL server
24305 Reset own database password succeeded in SQL server
24306 Reset own password failed in SQL server
24307 Reset database password succeeded in SQL server
24308 Reset database password failed in SQL server
24309 Copy passwordÿ in SQL server
24310 User-defined audit eventÿin SQL server
24311 Change database audit command issued in SQL server
24312 Create database audit command issued in SQL server
24313 Delete database audit command issued in SQL server
24314 Begin transaction command issued in SQL server
24315 Commit transaction command issued in SQL server
24316 Rollback transaction command issued in SQL server
24317 Create column master key command issued in SQL server
24318 Delete column master key command issued in SQL server
24319 Column master key viewed in SQL server
24320 Create column encryption key command issued in SQL server
24321 Change column encryption key command issued in SQL server
24322 Delete column encryption key command issued in SQL server
24323 Column encryption key viewed in SQL server
24324 Create database credential command issued in SQL server
24325 Change database credential command issued in SQL server
24326 Delete database credential command issued in SQL server
24327 Change database scoped configuration command issued in SQL server
24328 Create external data source command issued in SQL server
24329 Change external data source command issued in SQL server
24330 Delete external data source command issued in SQL server
24331 Create external file format command issued in SQL server
24332 Delete external file format command issued in SQL server
24333 Create external resource pool command issued in SQL server
24334 Change external resource pool command issued in SQL server
24335 Delete external resource pool command issued in SQL server
24337 Global transaction login in SQL server
24349 Change assembly owner command issued in SQL server