I am just learning about
SQL Extended Events.
I have a small event and for actions I have selected both
When I test connect with a NT account the event captures the NT account in both fields. When I test connect with a SQL Server Authentication account, only the
sqlserver.username field captures the account, I can understand why the NT field does not capture non-NT accounts.
It looks like
sqlserver.username captures everything, while
sqlserver.nt_username is more selective.
Other then what I have mentioned are there any differences between these two? Is there any case when
sqlserver.nt_username might capture something NOT captured by
In this case I am using the event
sqlserver.sql_batch_starting but my question is for any event. With SQL versions 2012 to 2017.
Note: Both of these fields are actions, so grabbing both increases overhead. While it is probably not significant overhead, I am trying to stay as lite as possible.