Difference between sqlserver.nt_username & sqlserver.username

Question

I am just learning about SQL Extended Events.

I have a small event and for actions I have selected both sqlserver.nt_username & sqlserver.username

When I test connect with a NT account the event captures the NT account in both fields. When I test connect with a SQL Server Authentication account, only the sqlserver.username field captures the account, I can understand why the NT field does not capture non-NT accounts.

It looks like sqlserver.username captures everything, while sqlserver.nt_username is more selective.

Other then what I have mentioned are there any differences between these two? Is there any case when sqlserver.nt_username might capture something NOT captured by sqlserver.username?

In this case I am using the event sqlserver.sql_batch_starting but my question is for any event. With SQL versions 2012 to 2017.

Note: Both of these fields are actions, so grabbing both increases overhead. While it is probably not significant overhead, I am trying to stay as lite as possible.

Answer 1

In the vast majority of cases, they should match and you only need to capture the "sqlserver.username" field. There could be some cases where the integrated login (the nt_username) is mapped to something else or there's a certificate or something more complicated where it could show you who is logging in and it will map to something different in the username field, but I've never seen this happen on an actual server.

They're separate values because they can be different, but I've never seen a case where they are.