No, the connection properties should be immutable. However, even if you could edit them, there is still an easier (and better) way to correlate Logon Events to the same Connection: the connect_time
field in sys.dm_exec_connections. You just look up that field based on the session_id
(which correlates to SPID
in the XML returned from the EVENTDATA() function). If your audit table does not already have fields for SessionID
and ConnectionTime
you will need to add one or both of them. And it probably would be wise to create a Non-Clustered Index on (ConnectionTime DESC, SessionID)
. Finally, in your Logon Trigger after you do the lookup for @ConnectionTime
, do an IF NOT EXISTS
to check your audit table for that combination of @ConnectionTime
and @SessionID
and only INSERT
if not found.
The following is a basic example of how to capture this info, but does not include the Index or the IF NOT EXISTS
logic:
Create the audit Table
--DROP TABLE Test.dbo.LogonEvent;
CREATE TABLE Test.dbo.LogonEvent
(
LogonEventID INT NOT NULL IDENTITY(-2140000000, 1),
SessionID INT NOT NULL,
ConnectionTime DATETIME NOT NULL,
EventInfo XML NULL
) ON [Tables];
GO
Create the Logon Trigger
ALTER TRIGGER CaptureLogonEvents
ON ALL SERVER
FOR LOGON
AS
SET NOCOUNT ON;
DECLARE @SessionID INT = EVENTDATA().value('(/EVENT_INSTANCE/SPID)[1]', 'INT');
INSERT INTO [Test].[dbo].[LogonEvent] (SessionID, ConnectionTime, EventInfo)
SELECT @SessionID AS [SessionID],
sdec.connect_time AS [ConnectionTime],
EVENTDATA() AS [EventInfo]
FROM sys.dm_exec_connections sdec
WHERE sdec.session_id = @SessionID;
GO