With the following table:
CREATE TABLE [Test]
(
[Id] BIGINT IDENTITY NOT NULL,
[Name] CHARACTER VARYING(255) NOT NULL,
[Description] CHARACTER VARYING(MAX) NOT NULL,
PRIMARY KEY([Id])
);
I control creation of new records with the stored procedure:
CREATE PROCEDURE [Test_Create]
@SessionId BINARY(32),
@Name CHARACTER VARYING(255),
@Description CHARACTER VARYING(MAX)
AS
BEGIN
BEGIN TRANSACTION;
BEGIN TRY
INSERT INTO [Test] ([Name], [Description])
VALUES (@Name, @Description);
END TRY
BEGIN CATCH
ROLLBACK TRANSACTION;
THROW;
END CATCH
COMMIT TRANSACTION;
END
I have a trigger that simply logs the before and after values for this table, for all changes. When my stored procedure is called, this trigger is fired and logs to another table. However, my trigger obviously cannot have the @SessionId
variable to log which website user session caused the stored procedure to be invoked by the SQL client running on a web server. I do not want to use SET CONTEXT_INFO
because it is unstable with connection pooling and parallel execution plans.
That said, I thought I could correlate the @SessionId
passed in to the stored procedure with the @@SPID
value, but again this is a little tricky with connection pooling. It won't work, as far as I can tell.
How can I track which user on my website, assuming I have a unique session number for them passed into my stored procedure, caused specific changes to any of my tables?
If they invoke a stored procedure, I need to know the stored procedure invoked and how it altered the tables (before and after values).
Is there perhaps an alternative to retrieve the following information and link them together to form an audit trail?
- The website user/session that caused a stored procedure to be invoked
- The stored procedure that was invoked and its parameters
- The resultant data queries
- The effects of the queries (before and after data)