SQL Server Audit Trail Generation
faq
Q: How does OmniAudit know when my data has been changed?
A: OmniAudit installs triggers on the tables you select to audit. Triggers are events that automatically execute every time a row in a given table is inserted, updated, or deleted.  OmniAudit's triggers are specially built to examine the columns you've selected to audit in that table to determine if the data in that column has been changed.
[back to top]
Q: What versions of SQL Server are supported?
A: OmniAudit supports SQL Server 7.0, 2000, and 2005 including MSDE and SQL Server Express editions.
[back to top]
Q: Do I have to change my existing applications to make OmniAudit work?
A: No. OmniAudit is completely installed on the database server and is transparent to all applications affecting the database.  This includes
  • All standard database tools such as Enterprise Manager and Query Analyzer.
  • All commercial applications such as Access and Excel.
  • All web applications based on CGI, Perl, ASP, ActiveX, Cold Fusion, etc.
  • All your existing proprietary applications.
[back to top]
Q: What information is captured by OmniAudit?
A: OmniAudit captures information for each row that is inserted, updated, or deleted.  For each column that you selected to audit in that table, the before and after values1,2 of the column are stored, as well as
  • The username of the person who made the change.
  • The date and time of the change.
  • The name of the application that was used to make the change.
  • The name of the computer the application was running on.
1 Before-and-after values are only available for update operations.  For inserts, the value of the column at the time of the insert is stored.  For deletes, the value of the column at the time of the delete is stored.

2 Due to how SQL Server handles BLOB data within triggers, before-and-after values are not available for text, ntext, or image columns.  In these cases, the value of the column after it was updated is all that is available and is all that OmniAudit posts to the audit log.

[back to top]
Q: Where is the audit log data stored?
A: Audit log data is stored within tables created by OmniAudit.  These tables can be installed in the same database being audited or in a different database on the same server.  These tables are fully queryable via SQL or other data access tools.

We also provide a companion application OmniAudit Log Viewer which makes it easy for you to sift through audit log records. You can filter and sort the audit log by audited table and audited column as well as date and time, user, application, etc. OmniAudit Log Viewer is a great tool for QA and Tech Support staff.

[back to top]
Q: How is the audit log data stored?
A: As we mentioned, audit log data is stored within database tables.  Numeric types such as int, decimal, float, etc. are converted to character representation when written to the audit log.  The same is true for binary, varbinary, and uniqueidentifier types. BLOB types (text, ntext, and image) are stored in dedicated tables which preserve their type.
[back to top]
Q: I don't want to audit everything in my database, just certain selected areas.  What control do I have over what is audited?
A: You have complete control over which tables are audited and which columns in those tables are audited.  In fact, you would be wise to carefully consider your audit plan, because the more you audit, the more space your audit log will occupy and the more activity your server will have to bear to perform the auditing.
[back to top]
Q: In some cases, I only care about changes to existing data, not new data or deleted data.  Do I have to audit all transactions on a given table?
A: No.  You can choose any combination of the insert, update, or delete operations, and you can change this selection table-by-table.  For example, some tables might audit all three operations while others may only audit update operations.
[back to top]
Q: What datatypes are supported?
A: All datatypes are supported in all SQL Server versions.
[back to top]
Q: How is OmniAudit affected by table structure changes after it's installed?
A: Generally, it is simply a matter of running the Audit Manager, selecting the table that was changed, and clicking "Build Triggers" to recreate the triggers for that table.
[back to top]
Q: Can I have my own triggers on the same table that is being audited by OmniAudit?
A: Yes you can.  SQL Server permits multiple triggers to exist on the same table.  OmniAudit's triggers will happily co-exist on a table side-by-side with any triggers of your own.
[back to top]