Server Audit Filter Values For [action_id]

( For an explanation of what these values are used for and why I published this chart, please see: Server Audit Mystery: Filtering action_id gets Error Msg 25713 )

The values in the chart below were taken from all versions of SQL Server starting with 2012 since that is when Server Audit’s first became filterable. Please see the “Update” section at the bottom of the post linked above for details regarding how this data was collected.

NOTE: Some values might have no effect as it is possible that some values might not show up in server audits. For example, the BATCH_COMPLETED_GROUP that became available in SQL Server 2016 is not in the “Audit Action Type” drop-down when managing Database Audit Specifications or Server Audit Specifications in SSMS (as of v17.7). It can be used in an ALTER DATABASE AUDIT SPECIFICATION [db_audit_spec_name] ADD (BATCH_COMPLETED_GROUP); statement, but if you do that, then you can no longer use the UI to manage that Audit Specification.

The number of values per each version are:

  • SQL Server 2012 = 125
  • SQL Server 2014 = 125
  • SQL Server 2016 = 141
  • SQL Server 2017 = 158


Available in SQL Server version:
Name ID Number 2012 2014 2016 2017
ACCESS AS 538989377 X X X X
ADD MEMBER APRL 1280462913 X X X X
ALTER AL 538987585 X X X X
ALTER CONNECTION ALCN 1313033281 X X X X
ALTER RESOURCES ALRS 1397902401 X X X X
ALTER SERVER STATE ALSS 1397967937 X X X X
ALTER SETTINGS ALST 1414745153 X X X X
ALTER TRACE ALTR 1381256257 X X X X
APPLICATION_ROLE_CHANGE_PASSWORD_GROUP PWAR 1380013904 X X X X
AUDIT SESSION CHANGED AUSC 1129534785 X X X X
AUDIT SHUTDOWN ON FAILURE AUSF 1179866433 X X X X
AUDIT_CHANGE_GROUP CNAU 1430343235 X X X X
AUTHENTICATE AUTH 1213486401 X X X X
BACKUP BA 538984770 X X X X
BACKUP LOG BAL 541868354 X X X X
BACKUP_RESTORE_GROUP BRDB 1111773762 X X X X
BATCH COMPLETED BCM 541934402 X X
BATCH STARTED BST 542397250 X X
BATCH_COMPLETED_GROUP BCMG 1196245826 X X
BATCH_STARTED_GROUP BSTG 1196708674 X X
BROKER LOGIN LGB 541214540 X X X X
BROKER_LOGIN_GROUP LGBG 1195525964 X X X X
BULK ADMIN ADBO 1329742913 X X X X
CHANGE DEFAULT DATABASE LGDB 1111770956 X X X X
CHANGE DEFAULT LANGUAGE LGLG 1196181324 X X X X
CHANGE LOGIN CREDENTIAL CCLG 1196180291 X X X X
CHANGE OWN PASSWORD PWCS 1396922192 X X X X
CHANGE PASSWORD PWC 541284176 X X X X
CHANGE USERS LOGIN USLG 1196184405 X X X X
CHANGE USERS LOGIN AUTO USAF 1178686293 X X X X
CHECKPOINT CP 538988611 X X X X
CONNECT CO 538988355 X X X X
COPY PASSWORD USTC 1129599829 X X X X
CREATE CR 538989123 X X X X
CREDENTIAL MAP TO LOGIN CMLG 1196182851 X X X X
DATABASE AUTHENTICATION FAILED DBAF 1178681924 X X X X
DATABASE AUTHENTICATION SUCCEEDED DBAS 1396785732 X X X X
DATABASE BULK ADMIN DABO 1329742148 X
DATABASE LOGOUT DBL 541868612 X X X X
DATABASE MIRRORING LOGIN LGM 541935436 X X X X
DATABASE_CHANGE_GROUP MNDB 1111772749 X X X X
DATABASE_LOGOUT_GROUP DAGL 1279738180 X X X X
DATABASE_MIRRORING_LOGIN_GROUP LGMG 1196246860 X X X X
DATABASE_OBJECT_ACCESS_GROUP ACDO 1329873729 X X X X
DATABASE_OBJECT_CHANGE_GROUP MNDO 1329876557 X X X X
DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP TODO 1329876820 X X X X
DATABASE_OBJECT_PERMISSION_CHANGE_GROUP GRDO 1329877575 X X X X
DATABASE_OPERATION_GROUP OPDB 1111773263 X X X X
DATABASE_OWNERSHIP_CHANGE_GROUP TODB 1111773012 X X X X
DATABASE_PERMISSION_CHANGE_GROUP GRDB 1111773767 X X X X
DATABASE_PRINCIPAL_CHANGE_GROUP MNDP 1346653773 X X X X
DATABASE_PRINCIPAL_IMPERSONATION_GROUP IMDP 1346653513 X X X X
DATABASE_ROLE_MEMBER_CHANGE_GROUP ADDP 1346651201 X X X X
DBCC DBCC 1128481348 X X X X
DBCC_GROUP DBCG 1195590212 X X X X
DELETE DL 538987588 X X X X
DENY D 538976324 X X X X
DENY WITH CASCADE DWC 541284164 X X X X
DISABLE LGDA 1094993740 X X X X
DROP DR 538989124 X X X X
DROP MEMBER DPRL 1280462916 X X X X
ENABLE LGEA 1095059276 X X X X
EXECUTE EX 538990661 X X X X
EXTERNAL ACCESS ASSEMBLY XA 538984792 X X X X
FAILED_DATABASE_AUTHENTICATION_GROUP DAGF 1179074884 X X X X
FAILED_LOGIN_GROUP LGFL 1279674188 X X X X
FULLTEXT FT 538989638 X X X X
FULLTEXT_GROUP FTG 541545542 X X X X
GLOBAL TRANSACTIONS LOGIN LGG 541542220 X X
GLOBAL_TRANSACTIONS_LOGIN_GROUP LGGG 1195853644 X X
GRANT G 538976327 X X X X
GRANT WITH GRANT GWG 541546311 X X X X
IMPERSONATE IMP 542133577 X X X X
INSERT IN 538988105 X X X X
LOGIN FAILED LGIF 1179207500 X X X X
LOGIN SUCCEEDED LGIS 1397311308 X X X X
LOGIN_CHANGE_PASSWORD_GROUP PWCG 1195595600 X X X X
LOGOUT LGO 542066508 X X X X
LOGOUT_GROUP LO 538988364 X X X X
MUST CHANGE PASSWORD PWMC 1129142096 X X X X
NAME CHANGE LGNM 1296975692 X X X X
NO CREDENTIAL MAP TO LOGIN NMLG 1196182862 X X X X
OPEN OP 538988623 X X X X
PASSWORD EXPIRATION PWEX 1480939344 X X X X
PASSWORD POLICY PWPL 1280333648 X X X X
RECEIVE RC 538985298 X X X X
REFERENCES RF 538986066 X X X X
RESET OWN PASSWORD PWRS 1397905232 X X X X
RESET PASSWORD PWR 542267216 X X X X
RESTORE RS 538989394 X X X X
REVOKE R 538976338 X X X X
REVOKE WITH CASCADE RWC 541284178 X X X X
REVOKE WITH GRANT RWG 541546322 X X X X
RPC COMPLETED RCM 541934418 X
RPC STARTED RST 542397266 X
SCHEMA_OBJECT_ACCESS_GROUP ACO 542065473 X X X X
SCHEMA_OBJECT_CHANGE_GROUP MNO 542068301 X X X X
SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP TOO 542068564 X X X X
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP GRO 542069319 X X X X
SELECT SL 538987603 X X X X
SEND SN 538988115 X X X X
SERVER CONTINUE SVCN 1313035859 X X X X
SERVER PAUSED SVPD 1146115667 X X X X
SERVER SHUTDOWN SVSD 1146312275 X X X X
SERVER STARTED SVSR 1381193299 X X X X
SERVER_OBJECT_CHANGE_GROUP MNSO 1330859597 X X X X
SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP TOSO 1330859860 X X X X
SERVER_OBJECT_PERMISSION_CHANGE_GROUP GRSO 1330860615 X X X X
SERVER_OPERATION_GROUP OPSV 1448300623 X X X X
SERVER_PERMISSION_CHANGE_GROUP GRSV 1448301127 X X X X
SERVER_PRINCIPAL_CHANGE_GROUP MNSP 1347636813 X X X X
SERVER_PRINCIPAL_IMPERSONATION_GROUP IMSP 1347636553 X X X X
SERVER_ROLE_MEMBER_CHANGE_GROUP ADSP 1347634241 X X X X
SERVER_STATE_CHANGE_GROUP STSV 1448301651 X X X X
SHOW PLAN SPLN 1313624147 X X X X
STATEMENT ROLLBACK UNDO 1329876565 X X
STATEMENT_ROLLBACK_GROUP UNDG 1195658837 X X
STORAGE LOGIN LGS 542328652 X
STORAGE_LOGIN_GROUP LGSG 1196640076 X
SUBSCRIBE QUERY NOTIFICATION SUQN 1313953107 X X X X
SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP DAGS 1397178692 X X X X
SUCCESSFUL_LOGIN_GROUP LGSD 1146308428 X X X X
TAKE OWNERSHIP TO 538988372 X X X X
TRACE AUDIT C2OFF C2OF 1179595331 X X X X
TRACE AUDIT C2ON C2ON 1313813059 X X X X
TRACE AUDIT START TASA 1095975252 X X X X
TRACE AUDIT STOP TASP 1347633492 X X X X
TRACE_CHANGE_GROUP TRCG 1195594324 X X X X
TRANSACTION BEGIN TXBG 1195530324 X X
TRANSACTION BEGIN COMPLETED TRBC 1128419924 X
TRANSACTION BEGIN STARTING TRBS 1396855380 X
TRANSACTION COMMIT TXCM 1296259156 X X
TRANSACTION COMMIT COMPLETED TRCC 1128485460 X
TRANSACTION COMMIT STARTING TRCS 1396920916 X
TRANSACTION PROMOTE COMPLETED TRPC 1129337428 X
TRANSACTION PROMOTE STARTING TRPS 1397772884 X
TRANSACTION PROPAGATE COMPLETED TRGC 1128747604 X
TRANSACTION PROPAGATE STARTING TRGS 1397183060 X
TRANSACTION ROLLBACK TXRB 1112692820 X X
TRANSACTION ROLLBACK COMPLETED TRRC 1129468500 X
TRANSACTION ROLLBACK STARTING TRRS 1397903956 X
TRANSACTION SAVEPOINT COMPLETED TRSC 1129534036 X
TRANSACTION SAVEPOINT STARTING TRSS 1397969492 X
TRANSACTION_BEGIN_GROUP TXGG 1195858004 X X
TRANSACTION_COMMIT_GROUP TXCG 1195595860 X X
TRANSACTION_GROUP TX 538990676 X X
TRANSACTION_ROLLBACK_GROUP TXRG 1196578900 X X
TRANSFER TRO 542069332 X X X X
UNLOCK ACCOUNT PWU 542463824 X X X X
UNSAFE ASSEMBLY XU 538989912 X X X X
UPDATE UP 538988629 X X X X
USER DEFINED AUDIT UDAU 1430340693 X X X X
USER_CHANGE_PASSWORD_GROUP UCGP 1346847573 X X X X
USER_DEFINED_AUDIT_GROUP UDAG 1195459669 X X X X
VIEW VW 538990422 X X
VIEW CHANGETRACKING VWCT 1413699414 X X X X
VIEW DATABASE STATE VDST 1414743126 X X X X
VIEW SERVER STATE VSST 1414746966 X X X X