Click here to Skip to main content
16,016,022 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
We have C2 trace auditing enabled for a database on Microsoft SQL server.
There is a lot of data being returned and the group responsible for reading it would like "excel" or similar format.
I'd like to import a .trc into powershell, do some filtering, and then export to a .csv.


Cheers,

- Umesh

What I have tried:

I've looked online for various nuget or other trace readers and though I could implement them, they don't read a .trc file.
Posted
Updated 9-Aug-24 19:00pm
Comments
Richard MacCutchan 10-Aug-24 4:48am    
So what is stopping you from proceeding?

Don't go throwing all your resources into a complete C2 audit solution. C2 was dropped in SQL Server last year in favor of Common Criteria Certification.

In the meantime, the C2 logs can be queried using a normal SQL SELECT query with a specialized FROM clause:
SQL
SELECT *
FROM ::fn_trace_gettable('path to .trc file', default)

You can throw your WHERE clause on that to implement your filtering. Whatever PowerShell you write can use a query like that to get the records, even remotely, then export the returned records to a CSV file however you want.
 
Share this answer
 
v2
Comments
0x01AA 10-Aug-24 13:41pm    
Great information. Thank you very much. 5.
If you're looking for an example of reading a trace file, there's an example published here[^].
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900