登录的监控

CREATE SERVER AUDIT  login_audit
        TO FILE (FILEPATH = 'c:\sqldata\login')
        WITH (QUEUE_DELAY = 0);
go
CREATE SERVER AUDIT SPECIFICATION login_audit_specification
FOR SERVER AUDIT login_audit
    add(SUCCESSFUL_LOGIN_GROUP)
--drop  server audit SPECIFICATION login_audit_specification

ALTER SERVER AUDIT login_audit
        WITH (STATE = on);
ALTER SERVER AUDIT SPECIFICATION login_audit_specification
WITH ( STATE = ON )
go
Select *-- event_time,statement,server_instance_name,server_principal_name
            FROM sys.fn_get_audit_file('c:\sqldata\login\*',null,null)
order by event_time desc