On the Users tab, you can configure the following settings for SQL Server data source:

Options Description

Specify users to track their activity

Select the option you need to fine-tune your SQL Server monitoring scope.

  • Monitor all users
  • Include only users matching these criteria
  • Exclude users matching these criteria

For example, you may need to track only actions performed by administrative accounts, or exclude the activity initiated by ordinary applications. If so, data should be filtered accordingly before it appears in search results, reports and Activity Summaries.

You can create either inclusion or exclusion lists. All filters are applied using AND logic.

To create a filter for user activity monitoring, select the related option and click the button on the right.

Specify the following:

  • User — enter the initiator's account as it appears in the "Who" column of reports and Activity Summaries, for example: mydomain\user1.

    TIP: For events containing “System” in the “Who” column you can enter "System" .

  • Workstation where activity was initiated — enter the workstation name as it is shown in the "Workstation" column of reports and Activity Summaries, for example: StationWin2016.
  • Application that initiated the activity — enter the application name as shown next to "Application name" in details of reports and Activity Summaries.

NOTE: You can use a wildcard (*) to replace any number of characters in filters.

TIP: In addition to the restrictions for a monitoring plan, you can use the *.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the *.txt files. Review the following for more information: Exclude Objects from Monitoring Scope