Page History

Versions Compared

Key

This line was added.
This line was removed.
Formatting was changed.

...

If you are subject to comply with regulations such as PCI DSS or HIPAA, you can use SQL Compliance Manager to configure your audit settings according to the specific guidelines of the regulation. SQL Compliance Manager then collects event data based on these guidelines and can provide a report that details the section of the regulation and the data collected using SQL Compliance Manager. You can apply the regulation guideline audit settings to one or more databases on a registered SQL Server instance. For more information, see Comply with specific regulations.

Understanding traces

On each registered SQL Server instance, the SQLcompliance SQL Compliance Manager Agent starts a SQL Server trace to copy SQL event log entries, called audit events, to trace files. Trace files are temporary files that store audit events until these events can be sent to the Collection Server. Trace files are located in a trace file directory on the audited SQL Server computer. For more information, see How the SQL Compliance Manager Agent works.

...

IDERA SQL Compliance Manager 5.4 5 includes support for event handling with SQL Server Extended Events. This optional feature is available for use in auditing instead of using SQL Trace. Running Extended Events offers a performance improvement over the default SQL Trace audit event gathering system and is available for instances running SQL Server 2012 and later. For more information about using the Extended Events option, see Using SQL Server Extended Events.

Using SQL Server Audit Logs

IDERA SQL Compliance Manager 5.5 includes support for event handling with SQL Server Audit Logs. This optional feature is available for use in auditing as an alternative to using SQL Server Extended Events or SQL Trace. Auditing via Audit Logs offers the ability to track your alerts for Agents running SQL Server 2017 and later. For more information about using the Audit Logs option, see Using SQL Server Audit Logs.

Using the Collection Server

The Collection Server stores the compressed trace files in the CollectionServerTraceFiles folder until the files can be processed. This folder is located under in the install directory (C:\Program Files\Idera\SQLcompliance) on the computer that hosts the Collection Server. The CollectionServerTraceFiles folder is also called a trace file directory , and is secured using ACL settings. You can specify a different location for the trace directory.

The Collection Server processes the raw audit events according to your settings and then sends the results to the appropriate event database in the Repository. The Collection Server creates an event database for each registered SQL Server instance. You can specify which audit events you want to track. You can also configure how the Collection Server and SQLcompliance SQL Compliance Manager Agent manage the trace files.

...

By designating trusted users, you can more efficiently audit databases used by third-party applications, such as SAP, that are is self-auditing. selfSelf-auditing applications are able to audit activity and transactions initiated by their service accounts. Because service accounts can generate a significant number of login and database change events, omitting these expected events from your audit data trail lets you more easily identify unexpected activity.

...

Note
It is important to note that the Before-After Data capture feature modifies the application schema by creating triggers on any table for which such data collection is enabled.