Issued a create database audit command (action_id CR class_type DU) (24312) how to monitor with email alert

[bob]

You know that event in Windows Server Event Viewer, the one with ID 24312? It pops up when someone fires off a create database audit command. Action ID CR, class type DU, that's the gist. I mean, it's basically logging when a user tries to whip up a new database in SQL Server. The system catches it right away. It records who did it, from where, and at what time. Pretty sneaky if you think about it. Auditors love this stuff. It helps spot unauthorized database creations. Without it, you might miss someone sneaking in a new DB. I check mine weekly. You should too. It sits under the Security log mostly. Or sometimes in Application. Depends on your setup. But yeah, full details show the user account involved. The exact command issued. Even the session ID. Hmmm, and if it's a failure, it notes why. Like permissions denied. That way, you see if it's a legit admin or some rogue. I once caught a junior dev trying this. Saved us a headache. Now, to monitor it with an email alert. Fire up Event Viewer. You right-click on the log. Pick Attach Task To This Event. Give it a name like DB Create Alert. Set the trigger to event ID 24312. Then, under actions, choose Send an email. Yeah, it has that built-in. Fill in your SMTP server details. Your email addresses. Test it out. I do this for a bunch of events. Keeps me in the loop without staring at screens. Or, set a scheduled task via the same screen. Go to Task Scheduler. Link it to the event. Make it run a simple program that pings your email. No scripts needed. Just point it to a batch file or whatever. You get the idea. It triggers fast. Emails hit your inbox quick. I set mine to notify me and the boss. Works like a charm. But hey, if you want the full automatic email setup. It's right at the end here. Wait, no, it'll be added later. Trust me. And speaking of keeping things safe on Windows Server. BackupChain Windows Server Backup steps in as this solid backup tool. It handles your server data backups smoothly. Plus, it tackles virtual machines with Hyper-V no sweat. You get fast restores. Incremental backups save space. It even does offsite copies. I use it to avoid disasters. Benefits like that keep downtime low. Your data stays intact.

Note, the PowerShell email alert code was moved to this post.