-5

I'm a SQL Server 2008 user. I have access to some tables. I need to request few columns from table as I usually do. But I need to do it once (for example) in 5 seconds and system administrators shouldn't see (feel:) my activity.

Result of request - table with approximately 100 lines. My query contains only select and where clause by index. (it is light and it is executing very fast)

As I know, SELECT operations don't write to transaction log. I mean, if I only read database, where is log of my select actions SQL Server keep? Can administrator see my select queries?

C2 audit, as I can see in properties, is disabled.

Is there any other ways to see my activity?

Thanks.

marc_s
  • 9,052
  • 6
  • 46
  • 52
Alexalex12
  • 3
  • 1
  • 3

3 Answers3

4

Auditing has been more improved in SQL Server 2008 and up. There are many ways to trace a SELECT .... (make sure you are not doing it against an HR database :-))

Option 1: Through SQL trace, where in depending on what trace events have been selected, you can get logged/audited.

Option 2: Under database --> Security --> Database Audit Specifications .

Here and here are 2 articles that have explained Option 2 in detail.

Kin Shah
  • 62,545
  • 6
  • 124
  • 245
0

Short answer: no. Sysadmins are gods.

Long answer:

Database administrators can use one or more of Server Audit (some editions of SQL Server 2008 and later), Change Data Capture (some editions of SQL Server 2008 and later, very limited information captures), Profiler (almost all editions and versions of SQL Server, including Analysis Services as well), SQL Trace (SQL Server 2008 and later, I think), DML Triggers (only for some operations) and DDL triggers (for SQL Server 2005 and later, and only for some operations).

Also Extended Events, as mentioned by Stray Cat below.

System administrators can use network sniffing to see everything you do on the network or remote control software to see everything you do on your workstation.

All of these can be completely invisible to you.

Modern operating systems almost all run on the assumption that you can't hide from sysadmins. If that were not the case then they would be unable to do their jobs.

Greenstone Walker
  • 4,389
  • 1
  • 17
  • 23
0

Tracking who-saw-what can be done through specially developed stored procedures and functions. In order to use this auditing method, access to the database must be limited through use of stored procedures (allowing EXEC statements only, while prohibiting all queries and DML operations). The result from a query is returned by a stored procedure, while at the same time the stored procedure logs the access in an appropriate auditing repository table along with additional information of interest (e.g. the time of the execution)

Also, SQL Server provides monitoring of selected events via the trace technology. It’s available through Application Programmer Interface (API), SQL Server Profiler as a GUI for viewing traces in real time, or by accessing saved trace files

The audited information contains the relevant information required for this type of auditing (e.g. the database and login name, the time of execution and the exact executed SELECT statement).

Ivan Stankovic
  • 637
  • 6
  • 6