The EVENTDATA() Function

    The use of the EVENTDATA() function within SQL Server allows us to extract valuable and necessary information pertaining to auditing and triggers, such as Event Notifications and DDL triggers.  The Database Engine strategically provides the capturing mechanism with a handful of well-structured data.

What is the format of this data?
    The format of the provided data is XML.  When working with EVENTDATA(), one of the best tools that you can use is the XML Schema Definition to reference when looking for the elements you’d like to query and capture.  This XSD can be found at the following link: SQL Server EVENTDATA() XSD file.  This definition is dauntingly vast, but there’s a neat little trick.  In order to quickly search through this XML Schema Definition file, you simple need to search for the keyword “EVENT_INSTANCE_EventType“.  For instance, say you are creating a DDL Trigger for the CREATE_PROCEDURE event.  Search for the text “EVENT_INSTANCE_CREATE_PROCEDURE”, and you will be brought to your desired event and containing elements:

  <!– Basic Envelope –>
  <xs:element name=”EventType” type=”SSWNAMEType”/>
  <xs:element name=”PostTime” type=”xs:string”/>
  <xs:element name=”SPID” type=”xs:int”/>
  <!– Server Scoped DDL –>
  <xs:element name=”ServerName” type=”PathType”/>
  <xs:element name=”LoginName” type=”SSWNAMEType”/>
  <!– DB Scoped DDL –>
  <xs:element name=”UserName” type=”SSWNAMEType”/>
  <!– Main Body –>
  <xs:element name=”DatabaseName” type=”SSWNAMEType”/>
  <xs:element name=”SchemaName” type=”SSWNAMEType”/>
  <xs:element name=”ObjectName” type=”SSWNAMEType”/>
  <xs:element name=”ObjectType” type=”SSWNAMEType”/>
  <xs:element name=”TSQLCommand” type=”EventTag_TSQLCommand”/>
This is the bulk of the information you’ll need in order to start utilizing the EVENTDATA() function.
Using the EVENTDATA() function
    Say you want to create a DDL Trigger in order to gather event information for the CREATE PROCEDURE command.  In the aforementioned paragraph, we already have laid out the elements that we can use and capture, as well as their names and types.  In the interest of an example, let’s create a database and some basic objects to illustrate this trigger.
use master;
create database EventDataDemo;
use EventDataDemo;
create table DdlAudit
       EventType nvarchar(128) null,
       DatabaseName nvarchar(128) null,
       SchemaName nvarchar(128) null,
       ObjectName nvarchar(128) null,
       LoginName nvarchar(128) null,
       UserName nvarchar(128) null,
       SqlText nvarchar(1024) null,
       AuditDateTime datetimenull

Now that we have the audit table setup, we can create the DDL Trigger that will be capturing and handling the CREATE PROCEDURE event.  This is one of those times where SQL Server XML knowledge comes in handy, as we’ll be relying heavily on the use of the XML value() method and an XQuery to extract our desired data.
create trigger DdlCreateProc
on all server
for create_procedure
       declare @eventdata xml = eventdata();
       insert into EventDataDemo.dbo.DdlAudit
              @eventdata.value(‘(/EVENT_INSTANCE/EventType)[1]’, ‘nvarchar(128)’),
              @eventdata.value(‘(/EVENT_INSTANCE/DatabaseName)[1]’, ‘nvarchar(128)’),
              @eventdata.value(‘(/EVENT_INSTANCE/SchemaName)[1]’, ‘nvarchar(128)’),
              @eventdata.value(‘(/EVENT_INSTANCE/ObjectName)[1]’, ‘nvarchar(128)’),
              @eventdata.value(‘(/EVENT_INSTANCE/LoginName)[1]’, ‘nvarchar(128)’),
              @eventdata.value(‘(/EVENT_INSTANCE/UserName)[1]’, ‘nvarchar(128)’),
To test out our audit, simple create a stored procedure and query the DdlAudit table.
use EventDataDemo;
create procedure dbo.MyTestProcedure
       select 1;
select *
from DdlAudit;

    The above example shows a good use of the EVENTDATA() function, and how you can extract valuable information from it under given circumstances.  If there are any comments, questions, or issues please feel free to leave a comment below or email me at

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s