Banks, credit unions, insurance companies,
"Who Changed" column in Netwrix Auditor - SQL Server reports shows "System"
|Symptoms||After restarting MS SQL Server, "Who Changed" column in Netwrix Auditor - SQL Server reports may show "System" while audit setting are disabled.|
|Cause||Netwrix Auditor - SQL Server checks and applies special tracing settings to the auditing of SQL Servers. These settings need to be enabled when MS SQL Server restarts.|
|Resolution||Perform the following steps:
1. Run the “sqlcr_sp.sql” (“sqlcr_sp_2000.sql” for MS SQL Server 2000) script file to create the stored procedure with the special settings (located in program installation directory).
2. Run the “sqlcr_startup.sql” script file to create the special stored procedure when MS SQL server restarts (located in program installation directory).
3. The special tracing settings will be enabled automatically after each restart of MS SQL Server. You can restart MS SQL Server when you need, and full audit data will be collected.
1. The account that runs this process should be granted the sysadmin server role.
2. If the MS SQL Server logs are not in the default folder, open the script file “sqlcr_sp.sql” or “sqlcr_sp_2000.sql” and change the path in the line “SET @pathtolog =” to the folder.
3. Microsoft SQL Server Management Studio is recommended for simplification of this process.