Monitoring sql server login attempts including IP ?! please help

Hello
I am using sql server 7 and I am doing a trace on successfull sql logins and
also on unsuccessfull ones.
Everything works fine, but the only thing missing for my trace to be
accepted is the origin IP address ?
I have to have the trace to have the IP adresse from where the sql login is
attempted from.
I know that from the process info I have the Host wich is actually fine, so
I imagine that the trace could include it or I could have a query to lookup
some other systable....
I really have to have this report....
Thanks !Trace (profiler) does not include the IP , and i don't know how to get it
( other than going through the hostname)
Wayne Snyder, MCDBA, SQL Server MVP
Computer Education Services Corporation (CESC), Charlotte, NC
www.computeredservices.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"simo sentissi" <simo_sentissi@.skc.edu> wrote in message
news:OdKP$brCEHA.2616@.TK2MSFTNGP12.phx.gbl...
> Hello
> I am using sql server 7 and I am doing a trace on successfull sql logins
and
> also on unsuccessfull ones.
> Everything works fine, but the only thing missing for my trace to be
> accepted is the origin IP address ?
> I have to have the trace to have the IP adresse from where the sql login
is
> attempted from.
> I know that from the process info I have the Host wich is actually fine,
so
> I imagine that the trace could include it or I could have a query to
lookup
> some other systable....
> I really have to have this report....
> Thanks !
>|||Hello Wayne
I actually can't even have the hostname from the trace, I get it from the
process info.
is there any way of cross querying the trace with the process info ? huhhh
now that I think of it, it will be pretty hard sine the failed login will
not show up on the process info.
thanks !
"Wayne Snyder" <wsnyder@.computeredservices.com> wrote in message
news:%23jKVuMsCEHA.1544@.TK2MSFTNGP09.phx.gbl...
> Trace (profiler) does not include the IP , and i don't know how to get it
> ( other than going through the hostname)
> --
> Wayne Snyder, MCDBA, SQL Server MVP
> Computer Education Services Corporation (CESC), Charlotte, NC
> www.computeredservices.com
> (Please respond only to the newsgroups.)
> I support the Professional Association of SQL Server (PASS) and it's
> community of SQL Server professionals.
> www.sqlpass.org
>
> "simo sentissi" <simo_sentissi@.skc.edu> wrote in message
> news:OdKP$brCEHA.2616@.TK2MSFTNGP12.phx.gbl...
> and
> is
> so
> lookup
>|||You can get the actual mac address for clients that are connected, but we
don't track the IP address for failed login attempts. I've requested this
feature for Yukon.
The only way you could capture this is to run a network trace on the server
while it's happening.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.

Monitoring sql server login attempts including IP ?! please help

Hello
I am using sql server 7 and I am doing a trace on successfull sql logins and
also on unsuccessfull ones.
Everything works fine, but the only thing missing for my trace to be
accepted is the origin IP address ?
I have to have the trace to have the IP adresse from where the sql login is
attempted from.
I know that from the process info I have the Host wich is actually fine, so
I imagine that the trace could include it or I could have a query to lookup
some other systable....
I really have to have this report....
Thanks !Trace (profiler) does not include the IP , and i don't know how to get it
( other than going through the hostname)
Wayne Snyder, MCDBA, SQL Server MVP
Computer Education Services Corporation (CESC), Charlotte, NC
www.computeredservices.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"simo sentissi" <simo_sentissi@.skc.edu> wrote in message
news:OdKP$brCEHA.2616@.TK2MSFTNGP12.phx.gbl...
> Hello
> I am using sql server 7 and I am doing a trace on successfull sql logins
and
> also on unsuccessfull ones.
> Everything works fine, but the only thing missing for my trace to be
> accepted is the origin IP address ?
> I have to have the trace to have the IP adresse from where the sql login
is
> attempted from.
> I know that from the process info I have the Host wich is actually fine,
so
> I imagine that the trace could include it or I could have a query to
lookup
> some other systable....
> I really have to have this report....
> Thanks !
>|||Hello Wayne
I actually can't even have the hostname from the trace, I get it from the
process info.
is there any way of cross querying the trace with the process info ? huhhh
now that I think of it, it will be pretty hard sine the failed login will
not show up on the process info.
thanks !
"Wayne Snyder" <wsnyder@.computeredservices.com> wrote in message
news:%23jKVuMsCEHA.1544@.TK2MSFTNGP09.phx.gbl...
> Trace (profiler) does not include the IP , and i don't know how to get it
> ( other than going through the hostname)
> --
> Wayne Snyder, MCDBA, SQL Server MVP
> Computer Education Services Corporation (CESC), Charlotte, NC
> www.computeredservices.com
> (Please respond only to the newsgroups.)
> I support the Professional Association of SQL Server (PASS) and it's
> community of SQL Server professionals.
> www.sqlpass.org
>
> "simo sentissi" <simo_sentissi@.skc.edu> wrote in message
> news:OdKP$brCEHA.2616@.TK2MSFTNGP12.phx.gbl...
> and
> is
> so
> lookup
>

Monitor SQL server activity

Hi,
This question has been asked thousand of times I'm sure
but anyway:
Does it exist an EASY way to monitor, or trace, or log the
activity on a specific database using sql server ?
In fact, I'd like to record all the SELECT made on a
database (having insert, delete, update would also be
great), without using third party tool and having a
readable log file.
Thanks,
OlivierHello,
Have you considered setting up a SQL Profile, and
configuring it to that one database, SQL Commands only ?
Thanks
Peter
>--Original Message--
>Hi,
>This question has been asked thousand of times I'm sure
>but anyway:
>Does it exist an EASY way to monitor, or trace, or log
the
>activity on a specific database using sql server ?
>In fact, I'd like to record all the SELECT made on a
>database (having insert, delete, update would also be
>great), without using third party tool and having a
>readable log file.
>Thanks,
>Olivier
>.
>

Monitor CPU Usage by Query?

The Profiler can do this. Create a new trace using the SQLProfilerStandard
trace template and add the CPU column. This will show both the query and the
CPU time, plus some other stuff. If this is a super busy production server
this can degrade performance so you might want to play with it on a test db
instance first. I typically run it from my desktop or from a remote desktop
and save the results to a local file cause if you write the result to the db
you are monitoring it too can impact your findings.
Netmon
"quixster@.gmail.com" wrote:

> We are currently running MS SQL 8.0 on Windows 2003. I've been tasked
> setting up a monitor that can identify queries that are causing CPU
> spikes.
> Does anyone have any suggestions about going about this? I'm at a
> complete loss.
>
Thanks for the tip! Do you know of any way to use this or some other
utility to create an alert for administrators to receive when a query
has risen above a certain threshold? I can see how I can filter the
trace for CPU usage of a certain level, but I don't see how I could use
that to create an alert. Any thoughts?
On Oct 31, 2:21 pm, Netmon <Net...@.discussions.microsoft.com> wrote:[vbcol=seagreen]
> The Profiler can do this. Create a new trace using the SQLProfilerStandard
> trace template and add the CPU column. This will show both the query and the
> CPU time, plus some other stuff. If this is a super busy production server
> this can degrade performance so you might want to play with it on a test db
> instance first. I typically run it from my desktop or from a remote desktop
> and save the results to a local file cause if you write the result to the db
> you are monitoring it too can impact your findings.
> Netmon
>
> "quixs...@.gmail.com" wrote:
|||No the trace is not going to do that. I'v heard that NetIQ has a product
that monitors for query execution but I'm not sure of the details on how it
works.
Like the other person (tootsuite) posted you could use perfmon however it
does not take sustained thresholds, that is if CPU > 90% over 60 seconds then
alert. So anytime the CPU is above your threshold it will alert even if it
is a short lived spike you get alerted.
I'm not sure the context within which you want to filter the trace to
generate an alert. If you have any enterprise server monitoring tools like
ProIT, MOM or Nimbus available you could just monitor the CPU via those and
have it email your admin.
Are you hoping to find the rogue/cpu intense queries in action? Or are you
desiring to know when the CPU gets hammered so an admin can log in and kill
the offending query or find out the user running it?
"quixster@.gmail.com" wrote:

> Thanks for the tip! Do you know of any way to use this or some other
> utility to create an alert for administrators to receive when a query
> has risen above a certain threshold? I can see how I can filter the
> trace for CPU usage of a certain level, but I don't see how I could use
> that to create an alert. Any thoughts?
>
> On Oct 31, 2:21 pm, Netmon <Net...@.discussions.microsoft.com> wrote:
>
|||Perfmon is just a general monitoring tool... you cannot see individual
queries.
Usually it works like this:
1. end users complain
2. look at overall picture using tool like perfmon or Quest Performance
Analysis, or even profiler (I find profiler to be flaky/unpredictable
at times, at least in 2000 it was terrible)
3. isolate queries using Quest based on various factors
4. most of our performance problems in the past have stemmed from
inadequate memory, which then in turns affects cpu, disk i/o, which
leads to blocking locks, etc - fortunately this has been resolved with
the purchase of higher performance servers + memory
so it's not enough to just isolate cpu performance, as many factors are
usually involved
so your cpu might be hammered, but the real underlying problem could be
lack of memory, etc but you wouldn't know that unless you can look at
all the various possible factors
Netmon wrote:[vbcol=seagreen]
> No the trace is not going to do that. I'v heard that NetIQ has a product
> that monitors for query execution but I'm not sure of the details on how it
> works.
> Like the other person (tootsuite) posted you could use perfmon however it
> does not take sustained thresholds, that is if CPU > 90% over 60 seconds then
> alert. So anytime the CPU is above your threshold it will alert even if it
> is a short lived spike you get alerted.
> I'm not sure the context within which you want to filter the trace to
> generate an alert. If you have any enterprise server monitoring tools like
> ProIT, MOM or Nimbus available you could just monitor the CPU via those and
> have it email your admin.
> Are you hoping to find the rogue/cpu intense queries in action? Or are you
> desiring to know when the CPU gets hammered so an admin can log in and kill
> the offending query or find out the user running it?
> "quixster@.gmail.com" wrote:
|||The first; trying to find rogue/cpu intense queries in action so we can
identify not only the query causing the problem, but perhaps what else
is occuring simultaneously that could be contributing to the high CPU
situation. We have MOM, and it can alert us to CPU incidents, but I
was hoping to find something that could single out the individual
queries that are running to create the incident.
On Oct 31, 4:30 pm, Netmon <Net...@.discussions.microsoft.com> wrote:[vbcol=seagreen]
> No the trace is not going to do that. I'v heard that NetIQ has a product
> that monitors for query execution but I'm not sure of the details on how it
> works.
> Like the other person (tootsuite) posted you could use perfmon however it
> does not take sustained thresholds, that is if CPU > 90% over 60 seconds then
> alert. So anytime the CPU is above your threshold it will alert even if it
> is a short lived spike you get alerted.
> I'm not sure the context within which you want to filter the trace to
> generate an alert. If you have any enterprise server monitoring tools like
> ProIT, MOM or Nimbus available you could just monitor the CPU via those and
> have it email your admin.
> Are you hoping to find the rogue/cpu intense queries in action? Or are you
> desiring to know when the CPU gets hammered so an admin can log in and kill
> the offending query or find out the user running it?
>
> "quixs...@.gmail.com" wrote:
>
>
|||Yes, you can do this easily using the query I provided in an earlier
post.
SELECT * FROM master..sysprocesses ORDER BY cpu DESC
DBCC INPUTBUFFER (spid) -- shows query
it can't get much clearer than this - it will list processes by CPU
usage, highest to lowest, at the given point in time you run the stmt
Or you can invest in some type of monitoring tool, like Quest
(performance analysis) or some other tool that you like if you need to
examine various performance indicators - this is what I would recommend
for a long term solution
hth
quixster@.gmail.com wrote:[vbcol=seagreen]
> The first; trying to find rogue/cpu intense queries in action so we can
> identify not only the query causing the problem, but perhaps what else
> is occuring simultaneously that could be contributing to the high CPU
> situation. We have MOM, and it can alert us to CPU incidents, but I
> was hoping to find something that could single out the individual
> queries that are running to create the incident.
>
> On Oct 31, 4:30 pm, Netmon <Net...@.discussions.microsoft.com> wrote:
|||Thanks for all the help! I'm taking the tips mentioned on this post
and also talking to a Quest rep about "Spotlight on SQL Server
Enterprise" http://www.quest.com/spotlight_on_sql_server_enterprise/
This has been immensely helpful!
On Nov 1, 11:20 am, tootsu...@.gmail.com wrote:[vbcol=seagreen]
> Yes, you can do this easily using the query I provided in an earlier
> post.
> SELECT * FROM master..sysprocesses ORDER BY cpu DESC
> DBCC INPUTBUFFER (spid) -- shows query
> it can't get much clearer than this - it will list processes by CPU
> usage, highest to lowest, at the given point in time you run the stmt
> Or you can invest in some type of monitoring tool, like Quest
> (performance analysis) or some other tool that you like if you need to
> examine various performance indicators - this is what I would recommend
> for a long term solution
> hth
>
> quixs...@.gmail.com wrote:
>
>
>
>
>
|||Another product that you might want to consider is Idera Diagnostic Manager
http://www.idera.com/Products/SQLdm/Default.aspx
Lucas
"quixster@.gmail.com" wrote:

> Thanks for all the help! I'm taking the tips mentioned on this post
> and also talking to a Quest rep about "Spotlight on SQL Server
> Enterprise" http://www.quest.com/spotlight_on_sql_server_enterprise/
> This has been immensely helpful!
> On Nov 1, 11:20 am, tootsu...@.gmail.com wrote:
>