I am just learning SQL Extended Events
.
I have a small event and for actions I have selected both sqlserver.nt_username
& sqlserver.username
When I use a NT account the event captures the NT account in both fields. When I use a SQL Server Authentication account, only the sqlserver.username
field captures the account, I can understand why the NT field does not capture non-NT accounts.
It looks like sqlserver.username
captures everything, while sqlserver.nt_username
is more selective.
Other then what I have mentioned are there any differences between these two? Is there any case when sqlserver.nt_username
might capture something NOT captured by sqlserver.username
?
In this case I am using the event sqlserver.sql_batch_starting
but my question is for any event. With SQL versions 2012 to 2017.
Note: Both of these fields are actions, so grabbing both increases overhead. While it is probably not significant overhead, I am trying to stay as lite as possible.