Since I started actively participating in SQL community, I found it is very common that people will approach to seek help on their SQL related issues. I do love to help people because it is always a win and win situation for both of us.
Recently, I had a phone conversation with one of the community members (CM) on one of the SQL issues. At some point, I asked him (CM) to capture some data for troubleshooting purpose. Below is what we discussed over the phone;
- ME: Can use the extended event to capture the advised data?
- CM: Can I use SQL Trace instead extended event (xEvents)?
- ME: Why SQL Trace… why not extended event?
- CM: I am very used to with SQL Trace. I find difficulties with the extended event because I don’t know what columns I need to select in the Extended Events. The column names are different in xEvents compare to SQL Trace.
- ME: Agreed the fact that xEvent names don’t match up to SQL Trace event names
The challenge which he faced that motivates me to write this blog. In this blog, you will explore all the SQL Trace columns are mapped to which extended events columns. You can run the below code to view the SQL Trace event, and its associated columns are mapped to which extended events and their associated columns.
SELECT DISTINCT tc.name 'Trace Category Name', te.name 'Trace Event Name', em.package_name AS 'xEvent Package Name', em.xe_event_name AS 'xEvent Name' FROM sys.trace_events te INNER JOIN sys.trace_categories tc ON te.category_id = tc.category_id LEFT OUTER JOIN sys.trace_xe_event_map em ON te.trace_event_id = em.trace_event_id
Below is the output of the script;
Trace Category Name | Trace Event Name | xEvent Package Name | xEvent Name |
Broker | Broker:Activation | sqlserver | broker_activation |
Broker | Broker:Connection | ucs | ucs_connection_setup |
Broker | Broker:Conversation | sqlserver | broker_conversation |
Broker | Broker:Conversation Group | sqlserver | broker_conversation_group |
Broker | Broker:Corrupted Message | sqlserver | broker_corrupted_message |
Broker | Broker:Forwarded Message Dropped | sqlserver | broker_forwarded_message_dropped |
Broker | Broker:Forwarded Message Sent | sqlserver | broker_forwarded_message_sent |
Broker | Broker:Message Classify | sqlserver | broker_message_classify |
Broker | Broker:Message Undeliverable | sqlserver | broker_message_undeliverable |
Broker | Broker:Mirrored Route State Changed | sqlserver | broker_mirrored_route_state_changed |
Broker | Broker:Queue Disabled | sqlserver | broker_queue_disabled |
Broker | Broker:Remote Message Acknowledgement | sqlserver | broker_remote_message_acknowledgement |
Broker | Broker:Transmission | sqlserver | broker_transmission_exception |
CLR | Assembly Load | sqlserver | assembly_load |
Cursors | CursorClose | sqlserver | cursor_close |
Cursors | CursorExecute | sqlserver | cursor_execute |
Cursors | CursorImplicitConversion | sqlserver | cursor_implicit_conversion |
Cursors | CursorOpen | sqlserver | cursor_open |
Cursors | CursorPrepare | sqlserver | cursor_prepare |
Cursors | CursorRecompile | sqlserver | cursor_recompile |
Cursors | CursorUnprepare | sqlserver | cursor_unprepare |
Database | Data File Auto Grow | sqlserver | database_file_size_change |
Database | Data File Auto Shrink | sqlserver | database_file_size_change |
Database | Database Mirroring Connection | ucs | ucs_connection_setup |
Database | Database Mirroring State Change | sqlserver | database_mirroring_state_change |
Database | Log File Auto Grow | sqlserver | database_file_size_change |
Database | Log File Auto Shrink | sqlserver | database_file_size_change |
Deprecation | Deprecation Announcement | sqlserver | deprecation_announcement |
Deprecation | Deprecation Final Support | sqlserver | deprecation_final_support |
Errors and Warnings | Attention | sqlserver | attention |
Errors and Warnings | Background Job Error | sqlserver | background_job_error |
Errors and Warnings | Bitmap Warning | sqlserver | bitmap_disabled_warning |
Errors and Warnings | Blocked process report | sqlserver | blocked_process_report |
Errors and Warnings | CPU threshold exceeded | sqlserver | cpu_threshold_exceeded |
Errors and Warnings | Database Suspect Data Page | sqlserver | database_suspect_data_page |
Errors and Warnings | ErrorLog | sqlserver | errorlog_written |
Errors and Warnings | EventLog | sqlserver | error_reported |
Errors and Warnings | Exception | sqlos | exception_ring_buffer_recorded |
Errors and Warnings | Exchange Spill Event | sqlserver | exchange_spill |
Errors and Warnings | Execution Warnings | sqlserver | execution_warning |
Errors and Warnings | Hash Warning | sqlserver | hash_warning |
Errors and Warnings | Missing Column Statistics | sqlserver | missing_column_statistics |
Errors and Warnings | Missing Join Predicate | sqlserver | missing_join_predicate |
Errors and Warnings | Sort Warnings | sqlserver | sort_warning |
Errors and Warnings | User Error Message | sqlserver | error_reported |
Full text | FT:Crawl Aborted | sqlserver | error_reported |
Full text | FT:Crawl Started | sqlserver | full_text_crawl_started |
Full text | FT:Crawl Stopped | sqlserver | full_text_crawl_stopped |
Locks | Deadlock graph | sqlserver | xml_deadlock_report |
Locks | Lock:Acquired | sqlserver | lock_acquired |
Locks | Lock:Cancel | sqlserver | lock_cancel |
Locks | Lock:Deadlock | sqlserver | lock_deadlock |
Locks | Lock:Deadlock Chain | sqlserver | lock_deadlock_chain |
Locks | Lock:Escalation | sqlserver | lock_escalation |
Locks | Lock:Released | sqlserver | lock_released |
Locks | Lock:Timeout | sqlserver | lock_timeout |
Locks | Lock:Timeout (timeout > 0) | sqlserver | lock_timeout_greater_than_0 |
Objects | Object:Altered | sqlserver | object_altered |
Objects | Object:Created | sqlserver | object_created |
Objects | Object:Deleted | sqlserver | object_deleted |
OLEDB | OLEDB Call Event | sqlserver | oledb_call |
OLEDB | OLEDB DataRead Event | sqlserver | oledb_data_read |
OLEDB | OLEDB Errors | sqlserver | oledb_error |
OLEDB | OLEDB Provider Information | sqlserver | oledb_provider_information |
OLEDB | OLEDB QueryInterface Event | sqlserver | oledb_query_interface |
Performance | Auto Stats | sqlserver | auto_stats |
Performance | Degree of Parallelism | sqlserver | degree_of_parallelism |
Performance | Performance statistics | sqlserver | query_cache_removal_statistics |
Performance | Performance statistics | sqlserver | query_pre_execution_showplan |
Performance | Performance statistics | sqlserver | uncached_sql_batch_statistics |
Performance | Plan Guide Successful | sqlserver | plan_guide_successful |
Performance | Plan Guide Unsuccessful | sqlserver | plan_guide_unsuccessful |
Performance | Showplan All | sqlserver | query_pre_execution_showplan |
Performance | Showplan All For Query Compile | sqlserver | query_post_compilation_showplan |
Performance | Showplan Statistics Profile | sqlserver | query_post_execution_showplan |
Performance | Showplan Text | sqlserver | query_pre_execution_showplan |
Performance | Showplan Text (Unencoded) | sqlserver | query_pre_execution_showplan |
Performance | Showplan XML | sqlserver | query_pre_execution_showplan |
Performance | Showplan XML For Query Compile | sqlserver | query_post_compilation_showplan |
Performance | Showplan XML Statistics Profile | sqlserver | query_post_execution_showplan |
Performance | SQL:FullTextQuery | NULL | NULL |
Progress Report | Progress Report: Online Index Operation | sqlserver | progress_report_online_index_operation |
Query Notifications | QN: Dynamics | sqlserver | qn_dynamics |
Query Notifications | QN: Parameter table | sqlserver | qn_parameter_table |
Query Notifications | QN: Subscription | sqlserver | qn_subscription |
Query Notifications | QN: Template | sqlserver | qn_template |
Scans | Scan:Started | sqlserver | scan_started |
Scans | Scan:Stopped | sqlserver | scan_stopped |
Security Audit | Audit Add DB User Event | NULL | NULL |
Security Audit | Audit Add Login to Server Role Event | NULL | NULL |
Security Audit | Audit Add Member to DB Role Event | NULL | NULL |
Security Audit | Audit Add Role Event | NULL | NULL |
Security Audit | Audit Addlogin Event | NULL | NULL |
Security Audit | Audit App Role Change Password Event | NULL | NULL |
Security Audit | Audit Backup/Restore Event | NULL | NULL |
Security Audit | Audit Broker Conversation | sqlserver | fulltextlog_written |
Security Audit | Audit Broker Login | NULL | NULL |
Security Audit | Audit Change Audit Event | NULL | NULL |
Security Audit | Audit Change Database Owner | NULL | NULL |
Security Audit | Audit Database Management Event | NULL | NULL |
Security Audit | Audit Database Mirroring Login | NULL | NULL |
Security Audit | Audit Database Object Access Event | NULL | NULL |
Security Audit | Audit Database Object GDR Event | NULL | NULL |
Security Audit | Audit Database Object Management Event | NULL | NULL |
Security Audit | Audit Database Object Take Ownership Event | NULL | NULL |
Security Audit | Audit Database Operation Event | NULL | NULL |
Security Audit | Audit Database Principal Impersonation Event | NULL | NULL |
Security Audit | Audit Database Principal Management Event | NULL | NULL |
Security Audit | Audit Database Scope GDR Event | NULL | NULL |
Security Audit | Audit DBCC Event | NULL | NULL |
Security Audit | Audit Fulltext | NULL | NULL |
Security Audit | Audit Login | sqlserver | login |
Security Audit | Audit Login Change Password Event | NULL | NULL |
Security Audit | Audit Login Change Property Event | NULL | NULL |
Security Audit | Audit Login Failed | NULL | NULL |
Security Audit | Audit Login GDR Event | NULL | NULL |
Security Audit | Audit Logout | sqlserver | logout |
Security Audit | Audit Object Derived Permission Event | NULL | NULL |
Security Audit | Audit Schema Object Access Event | NULL | NULL |
Security Audit | Audit Schema Object GDR Event | NULL | NULL |
Security Audit | Audit Schema Object Management Event | NULL | NULL |
Security Audit | Audit Schema Object Take Ownership Event | NULL | NULL |
Security Audit | Audit Server Alter Trace Event | NULL | NULL |
Security Audit | Audit Server Object GDR Event | NULL | NULL |
Security Audit | Audit Server Object Management Event | NULL | NULL |
Security Audit | Audit Server Object Take Ownership Event | NULL | NULL |
Security Audit | Audit Server Operation Event | NULL | NULL |
Security Audit | Audit Server Principal Impersonation Event | NULL | NULL |
Security Audit | Audit Server Principal Management Event | NULL | NULL |
Security Audit | Audit Server Scope GDR Event | NULL | NULL |
Security Audit | Audit Server Starts And Stops | sqlserver | server_start_stop |
Security Audit | Audit Statement Permission Event | NULL | NULL |
Server | Mount Tape | NULL | NULL |
Server | Server Memory Change | sqlserver | server_memory_change |
Server | Trace File Close | NULL | NULL |
Sessions | ExistingConnection | sqlserver | existing_connection |
Sessions | PreConnect:Completed | sqlserver | preconnect_completed |
Sessions | PreConnect:Starting | sqlserver | preconnect_starting |
Stored Procedures | RPC Output Parameter | sqlserver | rpc_completed |
Stored Procedures | RPC:Completed | sqlserver | rpc_completed |
Stored Procedures | RPC:Starting | sqlserver | rpc_starting |
Stored Procedures | SP:CacheHit | sqlserver | sp_cache_hit |
Stored Procedures | SP:CacheInsert | sqlserver | sp_cache_insert |
Stored Procedures | SP:CacheMiss | sqlserver | sp_cache_miss |
Stored Procedures | SP:CacheRemove | sqlserver | sp_cache_remove |
Stored Procedures | SP:Completed | sqlserver | module_end |
Stored Procedures | SP:Recompile | sqlserver | sql_statement_recompile |
Stored Procedures | SP:Starting | sqlserver | module_start |
Stored Procedures | SP:StmtCompleted | sqlserver | sp_statement_completed |
Stored Procedures | SP:StmtStarting | sqlserver | sp_statement_starting |
Transactions | DTCTransaction | sqlserver | dtc_transaction |
Transactions | SQLTransaction | sqlserver | sql_transaction |
Transactions | TM: Begin Tran completed | sqlserver | begin_tran_completed |
Transactions | TM: Begin Tran starting | sqlserver | begin_tran_starting |
Transactions | TM: Commit Tran completed | sqlserver | commit_tran_completed |
Transactions | TM: Commit Tran starting | sqlserver | commit_tran_starting |
Transactions | TM: Promote Tran completed | sqlserver | promote_tran_completed |
Transactions | TM: Promote Tran starting | sqlserver | promote_tran_starting |
Transactions | TM: Rollback Tran completed | sqlserver | rollback_tran_completed |
Transactions | TM: Rollback Tran starting | sqlserver | rollback_tran_starting |
Transactions | TM: Save Tran completed | sqlserver | save_tran_completed |
Transactions | TM: Save Tran starting | sqlserver | save_tran_starting |
Transactions | TransactionLog | sqlserver | transaction_log |
TSQL | Exec Prepared SQL | sqlserver | exec_prepared_sql |
TSQL | Prepare SQL | sqlserver | prepare_sql |
TSQL | SQL:BatchCompleted | sqlserver | sql_batch_completed |
TSQL | SQL:BatchStarting | sqlserver | sql_batch_starting |
TSQL | SQL:StmtCompleted | sqlserver | sql_statement_completed |
TSQL | SQL:StmtRecompile | sqlserver | sql_statement_recompile |
TSQL | SQL:StmtStarting | sqlserver | sql_statement_starting |
TSQL | Unprepare SQL | sqlserver | unprepare_sql |
TSQL | XQuery Static Type | sqlserver | xquery_static_type |
User configurable | UserConfigurable:0 | sqlserver | user_event |
User configurable | UserConfigurable:1 | sqlserver | user_event |
User configurable | UserConfigurable:2 | sqlserver | user_event |
User configurable | UserConfigurable:3 | sqlserver | user_event |
User configurable | UserConfigurable:4 | sqlserver | user_event |
User configurable | UserConfigurable:5 | sqlserver | user_event |
User configurable | UserConfigurable:6 | sqlserver | user_event |
User configurable | UserConfigurable:7 | sqlserver | user_event |
User configurable | UserConfigurable:8 | sqlserver | user_event |
User configurable | UserConfigurable:9 | sqlserver | user_event |
Thanks!
One thought on “Mapping SQL Trace to Extended Events”
Hello Dharmendra,
Thanks for the post.
I see so many So many events returned with NULL values.
Mainly i am looking to capture the below events
Audit Add Member to DB Role Event
Audit AddLogin Event
Audit Login GDR Event
Audit Login Change Password Event
Can you please let me know how we can replace the above in extended events.
Thanks in advance.