I am just learning about SQL Extended Events.

I have a small event and for actions I have selected both sqlserver.nt_username & sqlserver.username

When I test connect with a NT account the event captures the NT account in both fields. When I test connect with a SQL Server Authentication account, only the sqlserver.username field captures the account, I can understand why the NT field does not capture non-NT accounts.

It looks like sqlserver.username captures everything, while sqlserver.nt_username is more selective.

Other then what I have mentioned are there any differences between these two? Is there any case when sqlserver.nt_username might capture something NOT captured by sqlserver.username?

In this case I am using the event sqlserver.sql_batch_starting but my question is for any event. With SQL versions 2012 to 2017.

Note: Both of these fields are actions, so grabbing both increases overhead. While it is probably not significant overhead, I am trying to stay as lite as possible.

  • Yes that is correct. Even if you have a username that is different than corresponding login it will register login in case of AD accounts. – SqlWorldWide Dec 21 '18 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.