Microsoft SQL Server

DROP EVENT SESSION IF EXISTS TrackBackupCryptoFile ON SERVER;
GO

CREATE EVENT SESSION TrackBackupCryptoFile
ON SERVER
ADD EVENT sqlserver.sql_statement_completed
(
    ACTION (
        sqlserver.sql_text,
        sqlserver.username,
        sqlserver.client_hostname,
        sqlserver.nt_username
    )
    WHERE
        sqlserver.sql_statement_completed.statement LIKE '%BACKUP%CERTIFICATE%' OR
        sqlserver.sql_statement_completed.statement LIKE '%BACKUP%SERVICE%MASTER%KEY%' OR
        sqlserver.sql_statement_completed.statement LIKE '%BACKUP%MASTER%KEY%' OR
        sqlserver.sql_statement_completed.statement LIKE '%BACKUP%SYMMETRIC%KEY%'
)
ADD TARGET package0.event_file
(
    SET filename = 'C:\AuditLogs\TrackBackupCrypto.xel',
        max_file_size = 10,
        max_rollover_files = 5
);
GO

ALTER EVENT SESSION TrackBackupCryptoFile ON SERVER STATE = START;

CREATE VIEW dbo.BackupCryptoAuditLogView AS
SELECT
    event_xml.value('(event/@timestamp)[1]', 'datetime') AS EventTime,
    ISNULL(event_xml.value('(event/action[@name="username"]/value)[1]', 'nvarchar(100)'), 'N/A') AS SqlLogin,
    ISNULL(event_xml.value('(event/action[@name="client_hostname"]/value)[1]', 'nvarchar(100)'), 'N/A') AS HostName,
    ISNULL(event_xml.value('(event/action[@name="nt_username"]/value)[1]', 'nvarchar(100)'), 'N/A') AS WindowsUser,
    ISNULL(event_xml.value('(event/data[@name="statement"]/value)[1]', 'nvarchar(max)'), 'N/A') AS Statement,
    ISNULL(event_xml.value('(event/action[@name="sql_text"]/value)[1]', 'nvarchar(max)'), 'N/A') AS FullSQL
FROM sys.fn_xe_file_target_read_file('C:\AuditLogs\TrackBackupCrypto*.xel', NULL, NULL, NULL) AS xelog
CROSS APPLY (SELECT CAST(xelog.event_data AS XML) AS event_xml) AS evt;
GO

-- Создаем процедуру автозапуска
CREATE PROCEDURE StartTrackBackupCrypto
AS
BEGIN
    IF NOT EXISTS (
        SELECT * FROM sys.dm_xe_sessions WHERE name = 'TrackBackupCryptoFile'
    )
    BEGIN
        ALTER EVENT SESSION TrackBackupCryptoFile ON SERVER STATE = START;
    END
END;
GO

-- Включаем запуск при старте SQL Server
EXEC sp_procoption 'StartTrackBackupCrypto', 'startup', 'on';

GRANT SELECT ON dbo.BackupCryptoAuditLogView TO [имя пользователя];
EXEC sp_addrolemember 'db_datareader', [имя пользователя];
EXEC sp_addsrvrolemember 'VIEW SERVER STATE', [имя пользователя];