Jump to content


Photo

How to get audit for admin sql regarding command update delete table

SQL

  • Please log in to reply
12 replies to this topic

#1 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 28 November 2018 - 10:13 AM

HI team, 

Any Guides or links , How to audit SQL Admin regarding command Update, delete and others using Netwrix Auditor 8.0?

we configured the default audits, We receive the Alerts on the database creation and deletion test & bakcup restaute also the loggon but not on the update and other commands ?

Any idea please 

Regards 



#2 rihuka

rihuka

    Advanced Member

  • Administrators
  • PipPipPip
  • 55 posts
  • Gender:Male

Posted 28 November 2018 - 01:02 PM

Hi there,
 
The following guide might help you to configure Monitoring Plan, section "4.2.12. SQL Server":
https://www.netwrix....rator_Guide.pdf

 

I also attached the screenshot with list of necessary permissions for the data processing account.

 

In order to configure content audit, you should enable "Audit data changes" and configure rules per a certain scope e.g. server, database, table, column.

 

It is not recommended to use content audit against databases where information is changed by thousands of entries per second, for instance WSUS database, this might affect the entire SQL Server performance.

 

Just in case Netwrix Auditor 8.0 is not supported anymore, as well as documentation is related to 9.7, so I would recommend to update Netwrix Auditor to the latest version, there is no direct update to the latest version and if you have currently 8.0, you should update it following:

8.0 > 8.5 > 9.5 > 9.7

 

I believe much easier will be to remove current version and install the latest one, you may download it following the link:

https://www.netwrix....uct=CRsuitefull

 


Best regards,
Kirill Kirkov
T2 Support Engineer
 

#3 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 28 November 2018 - 01:14 PM

Hi Kirkov, 

Thanks for your feedback, juste to clarifie, Our needs , is to monitor , the operation for sql admin , for exapmle , command update, delete, 

So we must add  Audit data changes to perform this ? 

For the prerequisites , we added sysadmin and security admin on the audit User 

Regards  



#4 rihuka

rihuka

    Advanced Member

  • Administrators
  • PipPipPip
  • 55 posts
  • Gender:Male

Posted 28 November 2018 - 01:56 PM

That's right, it includes tracking for changes(e.g. insert, update, delete)

 

So we must add  Audit data changes to perform this ?


Best regards,
Kirill Kirkov
T2 Support Engineer
 

#5 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 28 November 2018 - 02:02 PM

Hi Kirkov

 

sorry for my English 

My question "So we must add  Audit data changes to perform this ?" what do you means about  Audit data changes, is't audit menu on sql server or other config ? 

regards 



#6 rihuka

rihuka

    Advanced Member

  • Administrators
  • PipPipPip
  • 55 posts
  • Gender:Male

Posted 28 November 2018 - 04:02 PM

 Audit data changes is the option of settings of Netwrix Auditor(9.7), please view the attached screenshot.

Attached Files


Best regards,
Kirill Kirkov
T2 Support Engineer
 

#7 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 29 November 2018 - 07:38 AM

Hi  Kirill Kirkov

thank you very mutch for your feedback , so this option does not exist on the version 8.0 :( 

 

Regards 



#8 rihuka

rihuka

    Advanced Member

  • Administrators
  • PipPipPip
  • 55 posts
  • Gender:Male

Posted 29 November 2018 - 10:52 AM

Hi there,

 

This option does exist even at 8.0 version however it has legacy name, as far as I know it is something like "database content audit".


Best regards,
Kirill Kirkov
T2 Support Engineer
 

#9 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 29 November 2018 - 01:10 PM

Hi 

Here are the default options for sql, on my server version 8.0

"sql server overwiew

all sql server changes

all sql server changes by users

all sql server changes by server

all sql server changes by obejects type

all sql sever data changes "

as you can see we have the options all sql sever data changes " But no alerte received  when the admin sql run the command update, delete and others :( 

regards 



#10 rihuka

rihuka

    Advanced Member

  • Administrators
  • PipPipPip
  • 55 posts
  • Gender:Male

Posted 29 November 2018 - 02:54 PM

Have you found the option "database content audit"?

 

Have you configured rules to track for the changes of a certain database?


Best regards,
Kirill Kirkov
T2 Support Engineer
 

#11 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 29 November 2018 - 02:57 PM

Hi , no options for "database content audit" :( we have just add sql server on target items to monitor our sql server test , and for report we have add and enabled all report by default , but no result, 

regards 



#12 rihuka

rihuka

    Advanced Member

  • Administrators
  • PipPipPip
  • 55 posts
  • Gender:Male

Posted 29 November 2018 - 06:42 PM

Install 9.7 version and I will guide you how to configure Netwrix Auditor to track for the changes.


Best regards,
Kirill Kirkov
T2 Support Engineer
 

#13 NABIL IT

NABIL IT

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 02 December 2018 - 09:08 AM

Thanks for your support, We will see with our top management if we can upgarde to the new version with our licence :) 

regards 






0 user(s) are reading this topic

0 members, guests, anonymous users