Manage audit event filters

The IDERA SQL Compliance Manager Audit Event Filters view allows you to filter out specific SQL events in the audit data collected from the SQL Server instances and databases you are auditing. Use audit event filters to refine your audit data trail so that it contains only the events you need to track.

Available actions

Filtering

Allows you to filter the listed event filters by status, instance name, and description. Filtering includes a Save View feature that lets you select all of your filtering options, and then save the settings for future use. Click Load View to select a previously-saved view for use.

Add New Filter

Allows you to create a new event filter using the New Event Filter wizard. IDERA SQL Compliance Manager stores this event filter in the Repository.

Export

Allows you to export Event Filters created for the associated SQL Server instance to an XML file. You can later use this file to import Event Filters across multiple SQL Server instances, ensuring consistent filtering of specific events throughout your environment.

Refresh

Allows you to update the Audit Event Filters list with current data.

Import

Allows you to import Event Filters previously exported from another SQL Server instance. By default, the imported Event Filters are disabled.

Edit Filter

Allows you to change an existing event filter using the New Event Filter wizard.

Enable / Disable

Allows you to enable or disable the associated event filter. When an event filter is enabled, SQL Compliance Manager processes audited events using the selected criteria in this filter.  If an event matches the filter criteria , SQL Compliance Manager removes the event from the audit data. Use the Audit Events tab to see the resultant set of processed events. When an event filter is disabled, you temporarily stop using the selected event filter. SQL Compliance Manager no longer uses this filter when processing events. All previously processed audit data stored in the Repository remains intact. To reinstate this filter, enable it.

Delete

Allows you to permanently delete the selected event filter. This option removes the filter from the Repository. SQL Compliance Manager will no longer use this filter when processing events. All previously processed audit data stored in the Repository remains intact.

Properties

Allows you to manage the properties for the selected event filter. This action launches the New Event Filter wizard, each window populated with event criteria from the selected filter.

From Existing

Allows you to create a new event filter using a selected filter as a template. This action launches the New Event Filter wizard, each window populated with event criteria from the selected filter. You can change any event criterion to meet the goals of your new filter. SQL Compliance Manager stores the new event filter in the Repository. The selected filter remains unchanged.

New Event Filter wizard

SQL Server Event Type window

The SQL Server Event Type window of the New Event Filter wizard allows you to specify the type of SQL Server event you want to filter from your audit data.

Available actions

Select type of event to filter from your audit data

Allows you to select the specific SQL Server event category or type you want to filter from your audit data. When the Collection Server processes an audited event that matches the specified event type, the filter is run to see whether the identified event matches the other filter criteria.

Edit filter details

Allows you to change your specified criteria at any time as you create your new filter. As you specify criteria using the New Event Filter wizard, the filter details grows to include these additional settings. To edit previously set criteria, click the corresponding setting.

SQL Server Object Type window

The SQL Server Object Type window of the New Event Filter wizard allows you to specify the type of SQL Server object affected by the filtered event. You can filter events that occur on specific audited databases and SQL Server instances.

Available actions

Select the SQL Server Objects

Allows you to specify the SQL Server object type that is affected by the event you want to filter. For example, you can filter out all DDL activity on a specific database. When the Collection Server processes an audited event associated with the specified object type, the filter is run to see whether the identified event matches the other filter criteria.

By default, the filter will apply your criteria against events on any audited SQL Server instance.

You can specify one or more objects:

For example, you can specify the following objects:

• • • Any database whose name contains the word test on the LABSERVER instance
    • The model database on any audited instance
    • The Salary table in the HR01 database hosted by the Chicago instance

Select the Event Type

Allows you specify the word or phrase the filter should use to identify objects affected by the event you want to filter from your audit data.

Finish Status Alert Rule window

The Finish Status Alert Rule window of the New Event Filter wizard allows you to review the filter details, select whether you want to Enable this filter now, and then click Finish. When you enable and complete this wizard, IDERA SQL Compliance Manager begins applying your filter criteria against audited events associated with the selected objects.

 

 

SQL Compliance Manager audits all activity on your server. Learn more > >

 

Save

Save

Save

Save

Save

Save