Filter out specific User's activity?

Binks

Hi,

We have a third party application that creates and drops tables frequently as part of its batch processing process. This results in a significant number of results being listed as drift even though these are expected and of no interest from an auditing perspective. All of this activity is generated by a specific service account.

Is it possible to filter out activity from specific user accounts?

In this particular case we can probably get away with filtering by an object name pattern, but we have other scenarios where filtering by the account is seemingly the only option to cut out a lot of the "noise" so to speak. An example of this is a service account that does index maintenance operations on a table regularly We don't care to log the index maintenance activity, but we don't want to exclude the entire table from the filter due to other DDL activity (expected and unexpected) that could occur on it.

Thanks,

Jason

Rob C

Hi Jason,

Unfortunately there's no way to filter by user account. If possible, what you could do is get the third party application to create all its tables under its own schema object - that way you could filter out anything under the schema.

Does that help?

Binks

Hi Robert,

Thank you for the response.

Fortunately the application is creating objects in its own schema already. To filter out those objects do I edit the "None" block in the scpf file similar to below where 'schemaname' would be replaced with the schema name I want to filter out?

<None version="1">
<Include>FALSE</Include>
<Expression>>(@NAME LIKE 'schemaname.%')</Expression>
</None>

Thanks again for your help.

Jason

Rob C

Hi Jason,

It's actually easier than that - you can use @SCHEMA to reference the schema. So you would do the following...

<None version="1">
<Include>FALSE</Include>
<Expression>(@SCHEMA = 'schemaname')</Expression>
</None>

Binks

Great! Easier is better.

I'll go ahead and make the change you specified. Thanks a bunch!