CODE: Audit who Dropped the Database

USE master;

GO
— Create the Event Session

IF EXISTS(SELECT *

FROM sys.server_event_sessions

WHERE name=’DBDeletedCreated’)

DROP EVENT SESSION DBDeletedCreated

ON SERVER;

GO

CREATE EVENT SESSION DBDeletedCreated

ON SERVER

ADD EVENT sqlserver.object_created (

SET collect_database_name = (1)

ACTION(sqlserver.nt_username,sqlserver.session_id,sqlserver.client_hostname,sqlserver.client_app_name,sqlserver.sql_text)

WHERE object_type = ‘DATABASE’

),

ADD EVENT sqlserver.object_deleted(

SET collect_database_name = (1)

ACTION(sqlserver.nt_username,sqlserver.session_id,sqlserver.client_hostname,sqlserver.client_app_name,sqlserver.sql_text)

WHERE object_type = ‘DATABASE’

)

ADD TARGET package0.event_file(SET filename=N’C:\Database\XE\DBDeletedCreated.xel’)

/* start the session */

ALTER EVENT SESSION DBDeletedCreated

ON SERVER

STATE = START;

GO