I'm configuring SQL Server Audit to log all INSERT, UPDATE, DELETE, and SELECT operations. I've tested and recorded everything I need (time, action, server principal, server instance, database name, object name, statement).
The only thing missing and that I couldn't find is the field that stores the changes before they're modified by UPDATE and DELETE. If someone changes them, I need to know what was stored beforehand.
Could someone help me? Thank you.
Auditing doesn't do that. If you need to see what data changed, your options are:
However, none of those naturally capture the details you're looking for with Auditing: time, action, server principal, server instance, database name, object name, statement. They only tell you what data changed.
Microsoft doesn't really have one feature that gets the whole boat (who, what, where, when). Why? I don't know. There may be third party tools out there that do it all, but I don't use or have any experience with them to give a recommendation.
