21 January 2020

Monitor Database Events

by Redgate Monitor Team

3,579 0 Auditing, Security

Install metric...

Metrics install automatically if you have Redgate Monitor installed.

If you are using Redgate’s SQL Server monitoring tool, Redgate Monitor, you can instantly install and run this metric on your servers.

This metric queries data from an Extended Events session to detect databases being dropped, created, started, stopped, attached or detached. It assigns a configurable “anxiety index” value (an integer from 1-10) to each detected event and then calculates a total based on the occurrences of these events over a period.

First, create and start for the following Extended Events session on the monitored SQL Server instance:

CREATE EVENT SESSION [DatabaseEvents] ON SERVER 
ADD EVENT sqlserver.database_attached(
    ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),
ADD EVENT sqlserver.database_created(
    ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),
ADD EVENT sqlserver.database_detached(
    ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),
ADD EVENT sqlserver.database_dropped(
    ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),
ADD EVENT sqlserver.database_started(
    ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),
ADD EVENT sqlserver.database_stopped(
    ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username))
ADD TARGET package0.ring_buffer(SET occurrence_number=(60))
WITH (STARTUP_STATE=ON)
GO  
 ALTER EVENT SESSION DatabaseEvents ON SERVER STATE = START;

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

CREATE EVENT SESSION [DatabaseEvents] ON SERVER

ADD EVENT sqlserver.database_attached(

ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),

ADD EVENT sqlserver.database_created(

ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),

ADD EVENT sqlserver.database_detached(

ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),

ADD EVENT sqlserver.database_dropped(

ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),

ADD EVENT sqlserver.database_started(

ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username)),

ADD EVENT sqlserver.database_stopped(

ACTION(sqlserver.client_app_name,sqlserver.database_name,sqlserver.sql_text,sqlserver.username))

ADD TARGET package0.ring_buffer(SET occurrence_number=(60))

WITH (STARTUP_STATE=ON)

GO

ALTER EVENT SESSION DatabaseEvents ON SERVER STATE = START;

For further details see: Checking for Database Events Using Extended Events and SQL Monitor.

Metric definition

Name

DatabaseEvents

Description

An anxiety level metric based on detection of databases being stopped, started, attached, detached, created or dropped. These actions should be unusual on a production server.

The T-SQL query that will collect data


		
			
			
Transact-SQL
			
			DECLARE @Target_Data XML =
            (
            SELECT TOP 1 Cast(xet.target_data AS XML) AS targetdata
              FROM sys.dm_xe_session_targets AS xet
                INNER JOIN sys.dm_xe_sessions AS xes
                  ON xes.address = xet.event_session_address
              WHERE xes.name = 'DatabaseEvents'
                AND xet.target_name = 'ring_buffer'
            );
SELECT COALESCE(Sum( CASE the.event_data.value('(@name)[1]', 'sysname') 
              WHEN 'database_started' THEN  1 --on a rating 1-10
              WHEN 'database_stopped' THEN 8  --on a rating 1-10
              WHEN 'database_attached' THEN 3 --on a rating 1-10
              WHEN 'database_detached' THEN 7 --on a rating 1-10
              WHEN 'database_created' THEN 4  --on a rating 1-10
              WHEN 'database_dropped' THEN 10 --on a rating 1-10
            END
          ),0)
    FROM @Target_Data.nodes('//RingBufferTarget/event') AS the(event_data)
  WHERE DateDiff (
          MINUTE, Convert(DATETIME2,
           SwitchOffset(
             Convert(DATETIMEOFFSET,
                     the.event_data.value('(@timestamp)[1]', 'datetime2')),
                     DateName(TzOffset,SysDateTimeOffset()))
          ), GetDate()) < 60 --AnxietyLevel is measured over a 60 minute span
			
				
					
				
					1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
				
						DECLARE @Target_Data XML =
            (
            SELECT TOP 1 Cast(xet.target_data AS XML) AS targetdata
              FROM sys.dm_xe_session_targets AS xet
                INNER JOIN sys.dm_xe_sessions AS xes
                  ON xes.address = xet.event_session_address
              WHERE xes.name = 'DatabaseEvents'
                AND xet.target_name = 'ring_buffer'
            );
SELECT COALESCE(Sum( CASE the.event_data.value('(@name)[1]', 'sysname') 
              WHEN 'database_started' THEN  1 --on a rating 1-10
              WHEN 'database_stopped' THEN 8  --on a rating 1-10
              WHEN 'database_attached' THEN 3 --on a rating 1-10
              WHEN 'database_detached' THEN 7 --on a rating 1-10
              WHEN 'database_created' THEN 4  --on a rating 1-10
              WHEN 'database_dropped' THEN 10 --on a rating 1-10
            END
          ),0)
    FROM @Target_Data.nodes('//RingBufferTarget/event') AS the(event_data)
  WHERE DateDiff (
          MINUTE, Convert(DATETIME2,
           SwitchOffset(
             Convert(DATETIMEOFFSET,
                     the.event_data.value('(@timestamp)[1]', 'datetime2')),
                     DateName(TzOffset,SysDateTimeOffset()))
          ), GetDate()) < 60 --AnxietyLevel is measured over a 60 minute span

Instances to collect from

Default

Databases to collect from

master

Collection frequency

1 min

Use collected or calculated values

Leave the Use a calculated rate of change between collections check box unchecked

Metric collection

Enabled

Alert definition

The appropriate alert threshold depends on how often these events are likely to occur on your systems. You should set the alert threshold after establishing a baseline for your working instance.

3,579 Rate

Click to rate this post!

[Total: 1 Average: 5]

What are custom metrics?

The Redgate Monitor custom metric feature lets you run T-SQL queries against your SQL Servers to collect specific data. You can analyze and receive alerts about your custom data just like everything else Redgate Monitor collects.

But what if you don’t want to write your own queries? No problem. Redgate has brought together a range of quality custom metrics for you to use in Redgate Monitor, which are all are free, tried and tested. You can install straight away, and use the resources on this site to help you write your own.

See the Getting Started guides

What is Redgate Monitor?

Redgate Monitor is a SQL Server performance monitoring tool that gives you real-time and historical SQL Server performance data with alerts and diagnostics.

With its embedded expertise from SQL Server experts and MVPs, it gives you the information and advice you need to find and fix issues before users are even aware.

Find out more about Redgate Monitor

Featured custom metrics

Total database file size
by Hugo Kornelis | 8,276 views | Memory Performance Storage
This custom metric measures the total database file size (data files and log file combined). An increase in this metric signals that a database was grown. When not done by the DBA, this is an autogrow. Excessive autogrow events should be prevented as this can result to file fragmentation. Try to manually grow files before […] Read more
Number of active backups and restores
by Redgate Monitor Team | 6,333 views | Performance
This metric will display the total number of active backups and restores on a server. This can be used to correlate with other metrics to explain why disk IO and CPU usage could have changed. Read more
Full backup to odd path
by Eelco Drost | 5,749 views | Compliance
This custom metric queries the MSDB database to search for multiple paths for a full backup Read more

See all custom metrics

Find metrics

See all metrics