Conditional Auditing

[KMoody]

Is it possible to audit an event only under certain conditions without using application level events?

For instance, let's say I have an integer field "ON-HAND" in the "ITEM" table. I want to audit updates to ON-HAND only if its new value is greater than 100. How can I do that?

 

[KMoody]

Maybe this is a better question:

How do I use the Criteria field (aud-event-policy._Event-criteria) in Audit Policy Maintenance? Where can I find the syntax for the criteria conditional? I was unable to find any documentation on this field.

 

[Rob Fitzpatrick]

It looks like you can do what you're looking for.

This is from _desc:

If auditing is enabled for the event by setting an event level greater than 0, then this field can optionally control the criteria under which the event should fire.
The meaning of the criteria is dependant on the type of event. An example for database connections could be a comma delimited list of databases that you are interested in auditing the connections for. If a database is connected that does not meet the criteria, then no audit data will be generated.

As stated, this is optional additional criteria and only relevant if the event auditing is enabled.

Sorry I don't know more than that. I'll ask one of our devs who works with auditing and see if he knows.

 

[Rob Fitzpatrick]

It seems we don't use _event-criteria, sorry.