< Back
Read-DbaAuditFile
Post
NAME Read-DbaAuditFile
SYNOPSIS
Read Audit details from *.sqlaudit files.
SYNTAX
Read-DbaAuditFile [-Path] <System.Object[]> [-Exact <Switch>] [-Raw <Switch>] [-EnableException <Switch>]
[<CommonParameters>]
DESCRIPTION
Read Audit details from *.sqlaudit files.
PARAMETERS
-EnableException [<Switch>]
By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables
advanced scripting.
Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own
try/catch.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Exact [<Switch>]
If this switch is enabled, only an exact search will be used for the Path. By default, this command will add a
wildcard to the Path because Eventing uses the file name as a template and adds characters.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Path [<System.Object[]>]
The path to the *.sqlaudit file. This is relative to the computer executing the command. UNC paths are
supported.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Raw [<Switch>]
If this switch is enabled, the Microsoft.SqlServer.XEvent.Linq.PublishedEvent enumeration object will be
returned.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
NOTES
Tags: ExtendedEvent, Audit
Author: Chrissy LeMaire (@cl), netnerds.net
Website: https://dbatools.io
Copyright: (c) 2018 by dbatools, licensed under MIT
License: MIT https://opensource.org/licenses/MIT
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Read-DbaAuditFile -Path C:\\temp\\logins.sqlaudit
Returns events from C:\\temp\\logins.sqlaudit.
-------------------------- EXAMPLE 2 --------------------------
PS C:\\>Get-ChildItem C:\\temp\\audit\\*.sqlaudit | Read-DbaAuditFile
Returns events from all .sqlaudit files in C:\\temp\\audit.
-------------------------- EXAMPLE 3 --------------------------
PS C:\\>Get-DbaInstanceAudit -SqlInstance sql2014 -Audit LoginTracker | Read-DbaAuditFile
Reads remote Audit details by accessing the file over the admin UNC share.
RELATED LINKS
https://dbatools.io/Read-DbaAuditFile
SYNOPSIS
Read Audit details from *.sqlaudit files.
SYNTAX
Read-DbaAuditFile [-Path] <System.Object[]> [-Exact <Switch>] [-Raw <Switch>] [-EnableException <Switch>]
[<CommonParameters>]
DESCRIPTION
Read Audit details from *.sqlaudit files.
PARAMETERS
-EnableException [<Switch>]
By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables
advanced scripting.
Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own
try/catch.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Exact [<Switch>]
If this switch is enabled, only an exact search will be used for the Path. By default, this command will add a
wildcard to the Path because Eventing uses the file name as a template and adds characters.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Path [<System.Object[]>]
The path to the *.sqlaudit file. This is relative to the computer executing the command. UNC paths are
supported.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Raw [<Switch>]
If this switch is enabled, the Microsoft.SqlServer.XEvent.Linq.PublishedEvent enumeration object will be
returned.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
NOTES
Tags: ExtendedEvent, Audit
Author: Chrissy LeMaire (@cl), netnerds.net
Website: https://dbatools.io
Copyright: (c) 2018 by dbatools, licensed under MIT
License: MIT https://opensource.org/licenses/MIT
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Read-DbaAuditFile -Path C:\\temp\\logins.sqlaudit
Returns events from C:\\temp\\logins.sqlaudit.
-------------------------- EXAMPLE 2 --------------------------
PS C:\\>Get-ChildItem C:\\temp\\audit\\*.sqlaudit | Read-DbaAuditFile
Returns events from all .sqlaudit files in C:\\temp\\audit.
-------------------------- EXAMPLE 3 --------------------------
PS C:\\>Get-DbaInstanceAudit -SqlInstance sql2014 -Audit LoginTracker | Read-DbaAuditFile
Reads remote Audit details by accessing the file over the admin UNC share.
RELATED LINKS
https://dbatools.io/Read-DbaAuditFile