Auditing: SQL Server’s Built-in Traces
Aside from the user-defined traces we have discussed throughout this chapter, SQL Server uses tracing to help you audit user activity using a few built-in configurations. In this section, we will briefly discuss the default trace, blackbox traces, and Common Criteria traces—all part of the same SQL Trace infrastructure, but configured and used slightly differently than the traces discussed in the rest of the chapter.
Upon first being installed, SQL Server 2005 starts up a background trace known as the default trace. If left in place, this trace will have a trace ID of 1, and you can see it in the sys.traces view using the following query:
SELECT * FROM sys.traces WHERE id = 1
The trace is ...