I am just learning SQL Extended Events.

I have a small event and for actions I have selected both sqlserver.nt_username & sqlserver.username

When I use a NT account the event captures the NT account in both fields. When I use a SQL Server Authentication account, only the sqlserver.username field captures the account, I can understand why the NT field does not capture non-NT accounts.

It looks like sqlserver.username captures everything, while sqlserver.nt_username is more selective.

Other then what I have mentioned are there any differences between these two? Is there any case when sqlserver.nt_username might capture something NOT captured by sqlserver.username?

In this case I am using the event sqlserver.sql_batch_starting but my question is for any event. With SQL versions 2012 to 2017.

Note: Both of these fields are actions, so grabbing both increases overhead. While it is probably not significant overhead, I am trying to stay as lite as possible.