SQL Server 监控login的IP

xuefuhe2026-08-01 14:50

extended events方式虽然也有IP选项，但后面3位被屏蔽成.xx，根本没用。

只好选择有trigger的方式。trigger设置得不正确，可能导致所有用户都登不上。

特此修改了一下，即使失败也不会影响登录

sql 复制代码

use DBWatch
go

CREATE TABLE [dbo].[dbadmin_audit_login](
	[LogDate] [datetime] NULL,
	[LoginName] [varchar](100) NULL,
	[ClientHost] [varchar](40) NULL
)
GO

CREATE NONCLUSTERED INDEX [idx_LogDate] ON [dbo].[dbadmin_audit_login]
(
	[LogDate] ASC
)
GO

sql 复制代码

CREATE TRIGGER [dbadmin_audit_login]
ON ALL SERVER 
WITH EXECUTE AS SELF
FOR LOGON
AS
BEGIN
    -- 1. Safely capture the event data in the native trigger context
    DECLARE @LogonData XML = EVENTDATA();

    -- 2. Check if the database 'dbadmin' exists and is online
    IF DB_ID('DBWatch') IS NOT NULL 
       AND DATABASEPROPERTYEX('DBWatch', 'Status') = 'ONLINE'
    BEGIN
        -- 3. Check if the table exists
        IF OBJECT_ID('DBWatch.dbo.dbadmin_audit_login', 'U') IS NOT NULL
        BEGIN
            BEGIN TRY
                -- 4. Parse XML and pass values into the dynamic SQL scope
                EXEC sp_executesql 
                    N'INSERT INTO DBWatch.dbo.dbadmin_audit_login (LogDate, LoginName, ClientHost) 
                      VALUES (
                          GETDATE(), 
                          @EventXML.value(''(/EVENT_INSTANCE/LoginName)[1]'', ''VARCHAR(100)''),
                          @EventXML.value(''(/EVENT_INSTANCE/ClientHost)[1]'', ''VARCHAR(40)'')
                      );',
                    N'@EventXML XML',
                    @EventXML = @LogonData;
            END TRY
            BEGIN CATCH
                -- Fails silently to prevent locking out users if an unexpected error occurs
            END CATCH
        END
    END
END

GO