Search code examples
sql-server-2000

Check who has logged in using SQL Server 2000 trc files

I'm trying to go through multiple .trc files to find out who has been logging into SQL Server over the last few months. I didn't setup the trace, but what I've got are a bunch of .trc files,

ex:

  • C:\SQLAuditFile2012322132923.trc,
  • C:\SQLAuditFile201232131931.trc

etc.

I can load these files into SQL Profiler and look at them individually, but I was hoping for a way to load them all up, so that I can quickly scan them for logins. Either using a filter, or better yet, load them into a SQL Server table and query them.

I tried loading the files into a table using:

 use <databasename>
 GO
 SELECT * INTO trc_table
 FROM ::fn_trace_gettable('C:\SQLAuditFile2012322132923.trc', 10);
 GO

But when I do this, i get the error message:

File 'C:\SQLAuditFile2012322132923.trc' either does not exist or is not a recognizable trace file. Or there was an error opening the file.

However, I know the file exists, and I have the correct name. Also they appear to be recognizable because I can load them up into SQL Profiler and view them fine.

Anybody have an idea why I'm getting this error message, and if this won't work, perhaps another way of analyzing these multiple .trc files more easily?

Thanks!

Solution

  • You may be having permissions issues on the root of C:. Try placing the file into a subfolder, e.g. c:\tracefiles\, and ensuring that the SQL Server account has at least explicit read permissions on that folder.

    Also try starting simpler, e.g.

    SELECT * FROM ::fn_trace_gettable('C:\SQLAuditFile2012322132923.trc', default);

    Anyway unless you were explicitly capturing successful login events, I don't know that these trace files are going to contain the information you're looking for... this isn't something SQL Server tracks by default.