{"name":"Login added to serverrole","description":"This custom metric queries the default trace to find events related to Server roles being altered","tsql":"SELECT COUNT(*) AS Result\r\nFROM sys.fn_trace_gettable(CONVERT(VARCHAR(150), (\r\n\t\t\t\tSELECT TOP 1 f.[value]\r\n\t\t\t\tFROM sys.fn_trace_getinfo(NULL) f\r\n\t\t\t\tWHERE f.property = 2\r\n\t\t\t\t)), DEFAULT) T\r\nINNER JOIN sys.trace_events e ON eventclass = trace_event_id\r\nINNER JOIN sys.trace_categories AS cat ON e.category_id = cat.category_id\r\nWHERE T.eventclass = 108 --AddLogin to serverrole Event\r\n\tAND t.eventsubclass = 1 --Add (2==Drop)\r\n\tAND t.StartTime BETWEEN DATEADD(MINUTE, - 2, GETDATE())\r\n\t\tAND GETDATE()\r\n","instances":true,"databases":{"mode":1},"frequency":60,"noalertremark":"You could add an alert once the baseline for your environment has been established.","metricenabled":true,"rateofchange":false,"aboveorbelow":"above","_thresholds_high":{"selected":false},"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"alertenabled":true,"targetentitytype":0}