Notebooks

Extended Event Creation.sql

CREATE EVENT SESSION [MonitorWindowsLogins] ON SERVER 
ADD EVENT sqlserver.login(
    ACTION(sqlserver.client_hostname,sqlserver.database_name,sqlserver.session_id,sqlserver.session_nt_username,sqlserver.session_server_principal_name)
    WHERE ([sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_nt_user],N'') 
    AND [sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_server_principal_name],N'THEBEARD\gsartori') 
    AND [sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_server_principal_name],N'THEBEARD\wdurkin') 
    AND [sqlserver].[not_equal_i_sql_unicode_string]([sqlserver].[session_server_principal_name],N'THEBEARD\Rob') 
    AND [sqlserver].[session_nt_user]<>N'THEBEARD\gfritchey' 
    AND [sqlserver].[session_server_principal_name]<>N'THEBEARD\SQL_SVC' 
    AND [sqlserver].[session_server_principal_name]<>N'THEBEARD\SQL2014SER12R2$'))
ADD TARGET package0.event_file(SET filename=N'MonitorWindowsLogins'),
ADD TARGET package0.histogram(SET filtering_event_name=N'sqlserver.login',source=N'sqlserver.session_server_principal_name')
WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=ON,STARTUP_STATE=ON)
GO