12 replies to this topic

[NABIL IT]

HI team, 

Any Guides or links , How to audit SQL Admin regarding command Update, delete and others using Netwrix Auditor 8.0?

we configured the default audits, We receive the Alerts on the database creation and deletion test & bakcup restaute also the loggon but not on the update and other commands ?

Any idea please 

Regards 

[Kirill K]

Hi there,
 
The following guide might help you to configure Monitoring Plan, section "4.2.12. SQL Server":
https://www.netwrix....rator_Guide.pdf

 

I also attached the screenshot with list of necessary permissions for the data processing account.

 

In order to configure content audit, you should enable "Audit data changes" and configure rules per a certain scope e.g. server, database, table, column.

 

It is not recommended to use content audit against databases where information is changed by thousands of entries per second, for instance WSUS database, this might affect the entire SQL Server performance.

 

Just in case Netwrix Auditor 8.0 is not supported anymore, as well as documentation is related to 9.7, so I would recommend to update Netwrix Auditor to the latest version, there is no direct update to the latest version and if you have currently 8.0, you should update it following:

8.0 > 8.5 > 9.5 > 9.7

 

I believe much easier will be to remove current version and install the latest one, you may download it following the link:

https://www.netwrix....uct=CRsuitefull

 

[NABIL IT]

Hi Kirkov, 

Thanks for your feedback, juste to clarifie, Our needs , is to monitor , the operation for sql admin , for exapmle , command update, delete, 

So we must add  Audit data changes to perform this ? 

For the prerequisites , we added sysadmin and security admin on the audit User 

Regards  

[Kirill K]

That's right, it includes tracking for changes(e.g. insert, update, delete)

 

So we must add  Audit data changes to perform this ?

[NABIL IT]

Hi Kirkov

 

sorry for my English 

My question "So we must add  Audit data changes to perform this ?" what do you means about  Audit data changes, is't audit menu on sql server or other config ? 

regards 

[Kirill K]

 Audit data changes is the option of settings of Netwrix Auditor(9.7), please view the attached screenshot.

Attached Files

•  Capture.PNG   120.21KB   2 downloads

[NABIL IT]

Hi  Kirill Kirkov

thank you very mutch for your feedback , so this option does not exist on the version 8.0  

 

Regards 

[Kirill K]

Hi there,

 

This option does exist even at 8.0 version however it has legacy name, as far as I know it is something like "database content audit".

[NABIL IT]

Hi 

Here are the default options for sql, on my server version 8.0

"sql server overwiew

all sql server changes

all sql server changes by users

all sql server changes by server

all sql server changes by obejects type

all sql sever data changes "

as you can see we have the options all sql sever data changes " But no alerte received  when the admin sql run the command update, delete and others  

regards 

[Kirill K]

Have you found the option "database content audit"?

 

Have you configured rules to track for the changes of a certain database?

[NABIL IT]

Hi , no options for "database content audit" we have just add sql server on target items to monitor our sql server test , and for report we have add and enabled all report by default , but no result, 

regards 

[Kirill K]

Install 9.7 version and I will guide you how to configure Netwrix Auditor to track for the changes.

[NABIL IT]

Thanks for your support, We will see with our top management if we can upgarde to the new version with our licence  

regards