<DESCRIPTION>Collection of database audit event classes.</DESCRIPTION>
<EVENTLIST>
<EVENT>
<ID>1</ID>
<NAME>Audit Login</NAME>
<DESCRIPTION>Collects all new connection events since the trace was started, such as when a client requests a connection to a server running an instance of SQL Server.</DESCRIPTION>
<EVENTCOLUMNLIST>
<EVENTCOLUMN>
<ID>0</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>2</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>3</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>22</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>23</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>24</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>25</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>32</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>33</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>35</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>36</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>37</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>40</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>43</ID>
</EVENTCOLUMN>
</EVENTCOLUMNLIST>
</EVENT>
<EVENT>
<ID>2</ID>
<NAME>Audit Logout</NAME>
<DESCRIPTION>Collects all new disconnect events since the trace was started, such as when a client issues a disconnect command.</DESCRIPTION>
<EVENTCOLUMNLIST>
<EVENTCOLUMN>
<ID>0</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>2</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>4</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>5</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>6</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>23</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>25</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>32</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>33</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>35</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>36</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>37</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>40</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>43</ID>
</EVENTCOLUMN>
</EVENTCOLUMNLIST>
</EVENT>
<EVENT>
<ID>4</ID>
<NAME>Audit Server Starts And Stops</NAME>
<DESCRIPTION>Records service shut down, start, and pause activities.</DESCRIPTION>
<DESCRIPTION>Query subcube, for Usage Based Optimization.</DESCRIPTION>
<EVENTCOLUMNLIST>
<EVENTCOLUMN>
<ID>0</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>1</ID>
<EVENTCOLUMNSUBCLASSLIST>
<EVENTCOLUMNSUBCLASS>
<ID>1</ID>
<NAME>Cache data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>2</ID>
<NAME>Non-cache data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>3</ID>
<NAME>Internal data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>4</ID>
<NAME>SQL data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>11</ID>
<NAME>Measure Group Structural Change</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>12</ID>
<NAME>Measure Group Deletion</NAME>
</EVENTCOLUMNSUBCLASS>
</EVENTCOLUMNSUBCLASSLIST>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>2</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>3</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>4</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>5</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>6</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>14</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>25</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>28</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>39</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>40</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>41</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>42</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>43</ID>
</EVENTCOLUMN>
</EVENTCOLUMNLIST>
</EVENT>
<EVENT>
<ID>12</ID>
<NAME>Query Subcube Verbose</NAME>
<DESCRIPTION>Query subcube with detailed information. This event may have a negative impact on performance when turned on.</DESCRIPTION>
<EVENTCOLUMNLIST>
<EVENTCOLUMN>
<ID>0</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>1</ID>
<EVENTCOLUMNSUBCLASSLIST>
<EVENTCOLUMNSUBCLASS>
<ID>21</ID>
<NAME>Cache data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>22</ID>
<NAME>Non-cache data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>23</ID>
<NAME>Internal data</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>24</ID>
<NAME>SQL data</NAME>
</EVENTCOLUMNSUBCLASS>
</EVENTCOLUMNSUBCLASSLIST>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>2</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>3</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>4</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>5</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>6</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>14</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>25</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>28</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>39</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>40</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>41</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>42</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>43</ID>
</EVENTCOLUMN>
</EVENTCOLUMNLIST>
</EVENT>
<EVENT>
<ID>60</ID>
<NAME>Get Data From Aggregation</NAME>
<DESCRIPTION>Answer query by getting data from aggregation. This event may have a negative impact on performance when turned on.</DESCRIPTION>
<EVENTCOLUMNLIST>
<EVENTCOLUMN>
<ID>0</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>2</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>3</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>4</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>5</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>6</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>14</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>25</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>28</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>39</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>40</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>41</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>42</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>43</ID>
</EVENTCOLUMN>
</EVENTCOLUMNLIST>
</EVENT>
<EVENT>
<ID>61</ID>
<NAME>Get Data From Cache</NAME>
<DESCRIPTION>Answer query by getting data from one of the caches. This event may have a negative impact on performance when turned on.</DESCRIPTION>
<EVENTCOLUMNLIST>
<EVENTCOLUMN>
<ID>0</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>1</ID>
<EVENTCOLUMNSUBCLASSLIST>
<EVENTCOLUMNSUBCLASS>
<ID>1</ID>
<NAME>Get data from measure group cache</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>2</ID>
<NAME>Get data from flat cache</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>3</ID>
<NAME>Get data from calculation cache</NAME>
</EVENTCOLUMNSUBCLASS>
<EVENTCOLUMNSUBCLASS>
<ID>4</ID>
<NAME>Get data from persisted cache</NAME>
</EVENTCOLUMNSUBCLASS>
</EVENTCOLUMNSUBCLASSLIST>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>2</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>3</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>4</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>5</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>6</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>14</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>25</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>28</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>39</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>40</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>41</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>42</ID>
</EVENTCOLUMN>
<EVENTCOLUMN>
<ID>43</ID>
</EVENTCOLUMN>
</EVENTCOLUMNLIST>
</EVENT>
</EVENTLIST>
</EVENTCATEGORY>
</EVENTCATEGORYLIST>
<COLUMNLIST>
<COLUMN>
<ID>0</ID>
<TYPE>1</TYPE>
<NAME>EventClass</NAME>
<DESCRIPTION>Event Class is used to categorize events.</DESCRIPTION>
<FILTERABLE>false</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>1</ID>
<TYPE>1</TYPE>
<NAME>EventSubclass</NAME>
<DESCRIPTION>Event Subclass provides additional information about each event class.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>2</ID>
<TYPE>5</TYPE>
<NAME>CurrentTime</NAME>
<DESCRIPTION>Time at which the event started, when available. For filtering, expected formats are 'YYYY-MM-DD' and 'YYYY-MM-DD HH:MM:SS'.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>3</ID>
<TYPE>5</TYPE>
<NAME>StartTime</NAME>
<DESCRIPTION>Time at which the event started, when available. For filtering, expected formats are 'YYYY-MM-DD' and 'YYYY-MM-DD HH:MM:SS'.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>4</ID>
<TYPE>5</TYPE>
<NAME>EndTime</NAME>
<DESCRIPTION>Time at which the event ended. This column is not populated for starting event classes, such as SQL:BatchStarting or SP:Starting. For filtering, expected formats are 'YYYY-MM-DD' and 'YYYY-MM-DD HH:MM:SS'.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>5</ID>
<TYPE>2</TYPE>
<NAME>Duration</NAME>
<DESCRIPTION>Amount of time (in milliseconds) taken by the event.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>6</ID>
<TYPE>2</TYPE>
<NAME>CPUTime</NAME>
<DESCRIPTION>Amount of CPU time (in milliseconds) used by the event.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>7</ID>
<TYPE>1</TYPE>
<NAME>JobID</NAME>
<DESCRIPTION>Job ID for progress.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>8</ID>
<TYPE>8</TYPE>
<NAME>SessionType</NAME>
<DESCRIPTION>Session type (what entity caused the operation).</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>9</ID>
<TYPE>1</TYPE>
<NAME>ProgressTotal</NAME>
<DESCRIPTION>Progress total.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>10</ID>
<TYPE>1</TYPE>
<NAME>IntegerData</NAME>
<DESCRIPTION>Integer data.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>11</ID>
<TYPE>8</TYPE>
<NAME>ObjectID</NAME>
<DESCRIPTION>Object ID (note this is a string).</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>12</ID>
<TYPE>1</TYPE>
<NAME>ObjectType</NAME>
<DESCRIPTION>Object type.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>13</ID>
<TYPE>8</TYPE>
<NAME>ObjectName</NAME>
<DESCRIPTION>Object name.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>14</ID>
<TYPE>8</TYPE>
<NAME>ObjectPath</NAME>
<DESCRIPTION>Object path. A comma-separated list of parents, starting with the object's parent.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>15</ID>
<TYPE>8</TYPE>
<NAME>ObjectReference</NAME>
<DESCRIPTION>Object reference. Encoded as XML for all parents, using tags to describe the object.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>22</ID>
<TYPE>1</TYPE>
<NAME>Severity</NAME>
<DESCRIPTION>Severity level of an exception.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>23</ID>
<TYPE>1</TYPE>
<NAME>Success</NAME>
<DESCRIPTION>1 = success. 0 = failure (for example, a 1 means success of a permissions check and a 0 means a failure of that check).</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>24</ID>
<TYPE>1</TYPE>
<NAME>Error</NAME>
<DESCRIPTION>Error number of a given event.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>25</ID>
<TYPE>1</TYPE>
<NAME>ConnectionID</NAME>
<DESCRIPTION>Unique connection ID.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>28</ID>
<TYPE>8</TYPE>
<NAME>DatabaseName</NAME>
<DESCRIPTION>Name of the database in which the statement of the user is running.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>false</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>32</ID>
<TYPE>8</TYPE>
<NAME>NTUserName</NAME>
<DESCRIPTION>Windows user name.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>33</ID>
<TYPE>8</TYPE>
<NAME>NTDomainName</NAME>
<DESCRIPTION>Windows domain to which the user belongs.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>35</ID>
<TYPE>8</TYPE>
<NAME>ClientHostName</NAME>
<DESCRIPTION>Name of the computer on which the client is running. This data column is populated if the host name is provided by the client.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>36</ID>
<TYPE>1</TYPE>
<NAME>ClientProcessID</NAME>
<DESCRIPTION>The process ID of the client application.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>37</ID>
<TYPE>8</TYPE>
<NAME>ApplicationName</NAME>
<DESCRIPTION>Name of the client application that created the connection to the server. This column is populated with the values passed by the application rather than the displayed name of the program.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>39</ID>
<TYPE>8</TYPE>
<NAME>SessionID</NAME>
<DESCRIPTION>Session GUID.</DESCRIPTION>
<FILTERABLE>false</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>40</ID>
<TYPE>8</TYPE>
<NAME>NTCanonicalUserName</NAME>
<DESCRIPTION>User name in canonical form. For example, engineering.microsoft.com/software/someone.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>41</ID>
<TYPE>1</TYPE>
<NAME>SPID</NAME>
<DESCRIPTION>Server process ID. This uniquely identifies a user session. This directly corresponds to the session GUID used by XML/A.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>42</ID>
<TYPE>9</TYPE>
<NAME>TextData</NAME>
<DESCRIPTION>Text data associated with the event.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>43</ID>
<TYPE>8</TYPE>
<NAME>ServerName</NAME>
<DESCRIPTION>Name of the server producing the event.</DESCRIPTION>
<FILTERABLE>true</FILTERABLE>
<REPEATABLE>true</REPEATABLE>
<REPEATEDBASE>false</REPEATEDBASE>
</COLUMN>
<COLUMN>
<ID>44</ID>
<TYPE>9</TYPE>
<NAME>RequestParameters</NAME>
<DESCRIPTION>Parameters for parameterized queries and commands.</DESCRIPTION>