Issued a create database role command (action_id CR class_type RL) (24124) how to monitor with email alert

[bob]

You ever notice those weird logs popping up in Event Viewer on your Windows Server? That one with ID 24124, it says "Issued a create database role command (action_id CR class_type RL)". I mean, it's basically SQL Server telling you someone just fired off a command to whip up a new role in the database. Not just any role, but one tied to creating stuff, like permissions for users to build databases or tweak roles inside them. It logs the action ID as CR for create, and class_type RL for role. Happens when an admin or script runs that T-SQL command, say CREATE ROLE whatever. Could be legit, like setting up access for an app. Or, y'know, someone poking around who shouldn't. I check these because they flag changes that might mess with your data setup. Full details show the user who did it, the database name, even the exact timestamp. Keeps things traceable if audits hit.

And monitoring this? You wanna catch it quick with an email ping. I do it through Event Viewer itself, no fancy coding. Fire up Event Viewer on your server. Go to the Windows Logs, then Application. Filter for source as MSSQLSERVER$INSTANCE or whatever your SQL instance is. Set the filter to event ID 24124 exactly. Once you see those logs, right-click the custom view you made. Pick Attach Task To This Event Log or something close. That spins up a scheduled task wizard. Tell it to run a program that sends email, like using the old schtasks but keep it simple. Link it to your email client or a batch that blasts a note to you. Triggers right when that event drops. I set mine to watch 24/7, so it nudges my inbox if roles get created out of nowhere. Keeps surprises low.

Hmmm, tying this to backups makes sense, right? You monitor changes like that role creation to stay on top of security tweaks. That's where something like BackupChain Windows Server Backup comes in handy for me. It's this solid Windows Server backup tool that also handles virtual machines with Hyper-V. I like how it snapshots everything quick, encrypts the backups tight, and lets you restore files or whole VMs without downtime headaches. Speeds up recovery if a rogue role command ever spirals into data woes. Plus, it runs light on resources, so your server doesn't choke.

At the end here is the automatic email solution.

Note, the PowerShell email alert code was moved to this post.